IronWorm npm Preinstall Hook Spawning Rust ELF Binary (tools/setup)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.