Node.js Temporary Script Execution

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects Node.js executing scripts matching a random temporary pattern (e.g., /tmp/pXXXXX.js). This pattern is generated by post-install scripts of malicious NPM packages, indicating potential supply chain compromise or malicious script execution.