Node.js Global Require Hijack and _V Persistence Marker - npm Infostealer

Ethan Andrews@eandrews

•updated Jun 25, 2026•1•0•3

Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.