IronWorm npm Supply-Chain Preinstall Binary Execution from node_modules

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects execution of unusual preinstall, setup, or GitHub scripts initiated by Node Package Manager (npm) or node processes. This behavior is indicative of a supply chain attack or malicious dependency execution during the installation process of a package.