Node.js runtime staging with malicious parser.js via npm install

Ankit Mehta@Secvyn

•updated Sep 4, 2026•0•0•1

This rule detects potentially suspicious activity involving the execution of node.js, npm, or curl where a specific node version (node-v20.11.1-darwin-x64) and a file named 'parser.js' appear in the command line within a short period. This pattern is indicative of a developer or attacker staging tools and scripts on a macOS system.