Trum3it Malicious npm postinstall/preinstall Hook Spawning Child Processes

Ethan Andrews@eandrews

•updated Jun 30, 2026•1•0•3

Detects instances where 'node.exe' executes common npm lifecycle scripts (e.g., preinstall, postinstall) that subsequently spawn suspicious child processes such as shell interpreters, network utilities, or scripting engines. This behavior is indicative of malicious packages (such as those associated with the Trum3it campaign) attempting to download or execute secondary payloads during the installation phase.