Malicious npm Postinstall/Preinstall Hook Executing Campaign Scripts
Detects node.js executing known malicious npm lifecycle scripts (such as install-check.cjs, verify-peer.cjs, sync-peer.cjs, postinstall-run.js, and preinstall.js) often found in node_modules folders. These scripts are associated with the Polymarket Trap supply chain campaign, which leverages malicious npm hooks for initial access or malicious activity within a development environment.
YARA-L
