IronWorm eBPF Rootkit - Rust ELF Loaded via npm Preinstall Hook on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potentially suspicious process execution behavior on Linux systems. It triggers on the execution of specific files often used as build tools or pre-check scripts ('/tools/setup', '/.github/scripts/precheck') or processes spawned from 'node_modules' directories by common Node.js package managers ('npm', 'node', 'npx') where the spawned executable lacks standard script file extensions (e.g., .js, .sh). This is indicative of potential execution of arbitrary binaries or obfuscated scripts within a development or CI/CD environment.