IronWorm: npm preinstall hook spawning Rust ELF binary (tools/setup) at install time

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.