NPM Package Install Executed From Suspicious Location - Linux

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of "npm install" via node on Linux from potentially suspicious directories. It might indicate a malicious package being installed or executed from a non-standard location. Attackers might use npm packages to execute malicious code on the victim's machine, potentially leading to data exfiltration, persistence, or further compromise of the system.

2026-06-08 00:00:00

None

a7b2c1d4-8e3f-4a5b-9c6d-1e0f2a3b4c5d

attack.execution attack.t1059.004

Nextron Sigma feed only (private)