tar.exe used to extract downloaded Node.js package archive

Detects tar.exe execution referencing Node.js package content, indicating LOLBin abuse to extract a downloaded Node.js archive as part of malware staging

YARA-L