Lazarus Contagious Interview: Malicious npm/Go Package Install or Fake Font JS Exec

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of common command-line tools (npm, node, or go) where the command arguments contain known malicious or suspicious strings associated with recent supply chain or exploitation activity (such as malicious npm packages, specific GitHub repositories, or unusual file path access).