PhantomRaven npm lifecycle script spawns node.exe with network callback
Detects anomalous network connections initiated by a node.exe process spawned by npm.exe within 2 minutes of a lifecycle script (preinstall or postinstall) execution. This behavior is indicative of malicious dependency installation where a compromised package attempts to exfiltrate data or fetch additional payloads immediately upon installation.
Microsoft Sentinel (KQL)
