Malicious npm/Packagist/Go postinstall script executing obfuscated JS loader

Ethan Andrews@eandrews

•updated Jul 2, 2026•6•0•7

Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.