IronWorm npm Preinstall Hook Spawning Native Binary from node_modules

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.