IronWorm AppInit_DLLs Registry Modification or regsvcs/regasm Spawned by npm

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects potential supply-chain attack activity related to IronWorm, including modifications to the AppInit_DLLs registry key and the execution of Windows utility binaries (regsvcs.exe, regasm.exe, InstallUtil.exe) by npm or node processes, which are commonly abused to facilitate malicious code execution during package installation.