Contagious Interview: jsonwebauth or Fake Font npm package execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.