IronWorm npm Supply-Chain: Malicious Preinstall Binary Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where npm or node processes spawn child processes associated with common software supply chain attack patterns, specifically targeting 'preinstall' or setup lifecycle hooks as seen in IronWorm-like activity. The rule monitors for child processes executing in 'tools/setup', '.github/scripts/precheck', or within 'node_modules/.bin' directories while filtering out legitimate node-gyp build operations.