IronWorm: UPX-modified Rust ELF executed via npm preinstall hook (tools/setup)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of setup or precheck scripts from specific paths ('/tools/setup' or '/.github/scripts/precheck') when spawned by common development-related shell or Node.js processes. This pattern often identifies anomalous build-time activities or execution of unauthorized configuration scripts in CI/CD or development environments.