Network Tool Executed During NPM Package Install

Description

Detect network tools being launched when an NPM package is installed. Malicious NPM packages may invoke preinstall or postinstall commands, which can involve network tools to download malicious payloads or exfiltrate sensitive information. Network tools spawned by npm, node, yarn, pnpm, bun, or related processes during package installation should be investigated. This rule complements the more generic "Launch Suspicious Network Tool in Container" rule with a specific focus on the supply chain attack vector via NPM packages.

Query · falco

spawned_process and container and network_tool_procs and npm_package_install_ancestor and not user_known_network_tool_in_npm_install_activities

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro network_tool_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro npm_package_install_ancestor
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_network_tool_in_npm_install_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Network tool executed during NPM package installation | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] exe_flags=%evt.arg.flags

Raw source Network Tool Executed During NPM Package Install · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Network Tool Executed During NPM Package Install
desc: 'Detect network tools being launched when an NPM package is installed. Malicious
  NPM packages may invoke  preinstall or postinstall commands, which can involve network
  tools to download malicious payloads or exfiltrate  sensitive information. Network
  tools spawned by npm, node, yarn, pnpm, bun, or related processes during  package
  installation should be investigated. This rule complements the more generic "Launch
  Suspicious Network  Tool in Container" rule with a specific focus on the supply
  chain attack vector via NPM packages.

  '
condition: 'spawned_process and container and network_tool_procs and npm_package_install_ancestor
  and not user_known_network_tool_in_npm_install_activities

  '
output: Network tool executed during NPM package installation | evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_sandbox
- container
- network
- process
- mitre_execution
- T1195.002

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.