Malicious npm postinstall/preinstall Scripts Executing Infostealer Payloads

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.