Malicious npm postinstall/preinstall lifecycle script executing dropper logic

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects the execution of Node.js lifecycle scripts (preinstall, postinstall, install-check, etc.) that trigger secondary process execution, such as command shells, downloaders (curl, wget), or security utilities (certutil, bitsadmin). This behavior is often associated with malicious npm package supply chain attacks aimed at downloading secondary payloads during installation.