npm postinstall spawns node executing mouse5212-super-formatter payload

Duo Tech@duotech

•updated Jul 15, 2026•0•0•1

This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.