IronWorm npm Package Trojanization via Stolen Credentials and Preinstall Hook

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.