IronWorm npm Supply-Chain: node/npm Spawning tools/setup or binding.gyp Binary

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects unauthorized execution of native binaries initiated by npm during the package installation process. This rule targets the IronWorm supply-chain campaign, where compromised npm packages utilize preinstall hooks or node-gyp build processes to execute malicious binaries (often Rust-based) from unconventional paths within the package directory.