IronWorm Trojanized npm Package Rust Binary Execution via Preinstall Hook

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of non-JavaScript ELF binaries (e.g., Rust-compiled binaries) from within npm package directories or specific setup paths, typically during 'preinstall' or 'postinstall' npm lifecycle hooks. This behavior is indicative of potential supply-chain attacks where malicious code is executed during dependency installation.