node executing the XOR loader or preinstall abuse from npm/node-gyp ancestry

F S@Fsdr

•updated Sep 3, 2026•2•0•4

This rule detects potentially malicious JavaScript files associated with known malicious patterns or suspicious 'preinstall' script behavior within Node.js environments. It monitors for the execution of specific suspicious filenames or the use of common Node.js package management tools (npm, yarn, etc.) in contexts suggesting code generation or build-time abuse.