Suspicious NPM Post-Install Script Execution

Yolanda Icepa@yicepa

•updated Jul 24, 2025•2•109

Detects the execution of suspicious commands commonly used for reconnaissance or networking, where the parent process command indicates it was triggered by an npm 'postinstall' script. This behavior is associated with the XORIndex loader used in the "Contagious Interview" campaign.