Node.js executes malicious code at @joyfill package import-time
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
Microsoft Sentinel (KQL)
