Outbound npm Registry Access by Suspicious Node or Bun Process

Hrushikesh Badgujar@H3AD

•updated Sep 12, 2026•2•0•4

Detects outbound network connections to 'registry.npmjs.org' originating from 'node' or 'bun' processes. This behavior may indicate an attempt to exfiltrate data, interact with malicious packages, or perform credential harvesting via npm tokens during execution.