Discord/LinkedIn contact followed by npm coding-assignment execution

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•7

Detects a suspected social engineering attack chain where a user communicates with a recruiter via messaging apps or browsers, subsequently clones or installs a malicious repository using 'npm' or 'VS Code', and triggers suspicious child process activity from 'node.exe'. This pattern is associated with the WaterPlum campaign.