Hijacked npm packages html-to-gutenberg and fetch-page-assets delivering malware

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the execution of Node.js processes associated with hijacked npm packages 'html-to-gutenberg' and 'fetch-page-assets'. The rule monitors for 'node' or 'node-gyp' processes spawned in conjunction with command-line arguments or file paths referencing these specific malicious packages, which are known to use binding.gyp command expansion for unauthorized code execution.