IronWorm npm Self-Propagation via Stolen Credentials and Malicious Postinstall Hook

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule monitors for suspicious activity associated with npm or Node.js processes. This includes potential credential misuse during npm publish or login, unauthorized build-time execution via node-gyp, and the use of unconventional preinstall/postinstall hooks that spawn external binaries or scripts, which are often indicative of software supply chain attacks.