BeaverTail npm Hijacked Package Postinstall Script Spawning Suspicious Child Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects malicious child process creation behavior associated with the BeaverTail JavaScript infostealer during the installation of compromised npm packages. The rule monitors for 'node.exe' spawning suspicious shell or interpreter processes (e.g., python, curl, powershell) in conjunction with strings indicative of known malicious delivery mechanisms (e.g., specific filenames like 'lserver.js', 'jsonwebauth', or external hosting domains).