IronWorm npm preinstall Hook Spawning Shell or Rust Binary via tools/setup

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for suspicious child processes spawned by Node.js or npm-related processes (e.g., node, npm, node-gyp). It identifies potentially malicious activity such as shells, Python scripts, or custom scripts executing within the context of 'preinstall', 'postinstall', or 'binding.gyp' phases, which are common vectors for software supply chain compromises via malicious npm packages.