npm preinstall hook launches obfuscated index.js
This rule catches a preinstall script running an obfuscated index.js before the main install completes. Preinstall runs automatically without user consent. Never ignore preinstall additions in dependency updates. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
