IronWorm Rust Infostealer Spawned from npm or node.exe Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects unexpected child process creation spawned by npm or node.exe that is characteristic of the IronWorm Rust-based infostealer. This rule monitors for malicious npm preinstall or postinstall hooks executing common living-off-the-land binaries (like curl, powershell, or regsvr32) from within a node_modules directory structure, common in supply chain compromise scenarios.