Fake Web3 Accelerator Drops Infostealers via Malicious npm Packages — Detection and Response Guide for Windows and macOS

---
title: npm or Node Lifecycle Script Spawning Shell or Download Utility
id: 3f8c2a71-9b4e-4d6a-b1c7-2e5f8a0d1b34
status: experimental
description: Detects node.exe/npm.cmd spawning command interpreters or download utilities, consistent with malicious npm lifecycle scripts (preinstall/postinstall) staging infostealer payloads as seen in the fake Web3 accelerator campaign.
references:
  - https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html
  - https://attack.mitre.org/techniques/T1195/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain_compromise
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
      - '\npx.cmd'
      - '\yarn.exe'
      - '\pnpm.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build tooling (node-gyp, esbuild post-install) — baseline per repo and alert on deviations
level: high
---
title: Suspicious Process Access to Browser Credential Stores or Crypto Wallets
id: 7d1e4b92-3c6f-4a8e-9d2b-5f7a1c3e8b56
status: experimental
description: Detects non-browser processes reading browser credential databases, cookie stores, or cryptocurrency wallet files — the collection behavior of the infostealer delivered by this campaign's malicious npm packages.
references:
  - https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
      - '\Mozilla\Firefox\Profiles\'
      - '\Opera Software\Opera Stable\'
      - '\Roaming\Exodus\'
      - '\Roaming\Electrum\'
      - '\Roaming\MetaMask\'
      - '.config\solana\'
  selection_files:
    TargetFilename|endswith:
      - 'Login Data'
      - 'Cookies'
      - 'Web Data'
      - 'logins.json'
      - 'key4.db'
      - 'wallet.dat'
      - 'Local State'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\opera.exe'
  condition: selection_target and selection_files and not filter_browser
falsepositives:
  - Enterprise password managers and EDR scanners legitimately reading browser stores — allowlist known good hashes
level: high
---
title: Node Process Executing Shell Commands on macOS
id: 9a5c3d18-2e7b-4f1a-8c4d-6b9e2f5a7c89
status: experimental
description: Detects node/npm child processes spawning shells, curl, or osascript on macOS — the install-time staging behavior used by this campaign's malicious npm packages against Mac developers.
references:
  - https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059.004
  - attack.supply_chain_compromise
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains:
      - '/node'
      - '/npm'
      - '/npx'
      - '/yarn'
      - '/pnpm'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'
      - '/curl'
      - '/osascript'
      - '/python'
      - '/python3'
  selection_args:
    CommandLine|contains:
      - 'curl '
      - 'http'
      - 'base64'
      - 'chmod +x'
      - 'LaunchAgents'
      - 'security find-generic-password'
  condition: selection_parent and selection_child and selection_args
falsepositives:
  - Legitimate postinstall compilation scripts — correlate with recently added or unpinned dependencies
level: high

// Hunt: npm/node spawning shells or download utilities (install-time staging),
// plus follow-on access to credential stores and AI API key locations
let ScriptHosts = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","curl.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe","regsvr32.exe","bash.exe","sh.exe"]);
let PackageManagers = dynamic(["node.exe","npm.cmd","npm.exe","npx.cmd","yarn.exe","pnpm.exe","bun.exe"]);
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ (PackageManagers)
    | where FileName in~ (ScriptHosts)
    | project StagingTime=TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessId, DeviceId;
let CredAccess =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any ("Login Data","Cookies","Web Data","key4.db","wallet.dat","Local State","find-generic-password",".env","ANTHROPIC_API_KEY","GEMINI_API_KEY","GOOGLE_API_KEY","claude")
       or FolderPath has_any ("\\Exodus\\","\\Electrum\\","\\MetaMask\\","solana")
    | project CredTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, DeviceId;
Staging
| join kind=leftouter CredAccess on DeviceName
| where isnull(CredTime) or CredTime between (StagingTime .. StagingTime + 2h)
| project StagingTime, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, CredAccess_Process = FileName1, CredAccess_CmdLine = ProcessCommandLine1
| sort by StagingTime desc

-- Hunt: Enumerate npm lifecycle scripts and node child processes across endpoints
-- Fake Web3 accelerator campaign: malicious preinstall/postinstall hooks stage infostealers

LET pkg_scripts = SELECT FullPath AS PackageJson,
       read_file(filename=FullPath, length=200000) AS Content
FROM glob(globs=[
  'C:/Users/*/*/package.json',
  'C:/Users/*/Documents/**/package.json',
  'C:/Users/*/source/**/package.json',
  'C:/Users/*/projects/**/package.json',
  '/Users/*/**/package.json'
])
WHERE Content =~ '"(preinstall|install|postinstall)"'
  AND Content =~ '(curl|wget|powershell|cmd |bash|sh |base64|http://|https://(?!registry.npmjs.org))'

LET node_children = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(cmd|powershell|pwsh|curl|bash|zsh|osascript|certutil|mshta)'
  AND CommandLine =~ '(curl|http|base64|-enc|iex|download|LaunchAgents|Login Data|Cookies)'

SELECT * FROM pkg_scripts
UNION ALL
SELECT NULL AS PackageJson,
       format(format='%v | %v | %v | %v', args=[Name, Pid, Username, CommandLine]) AS Content
FROM node_children

# Security Arsenal - Malicious npm Package Exposure Audit
# Run elevated on developer workstations / CI runners

$report = @()

# 1) Find package.json files with executable lifecycle hooks
$searchRoots = @("$env:USERPROFILE\source", "$env:USERPROFILE\Documents", "$env:USERPROFILE\Desktop", "$env:USERPROFILE\projects", "$env:USERPROFILE\dev")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Filter "package.json" -ErrorAction SilentlyContinue |
          Where-Object { $_.FullName -notmatch 'node_modules' } | ForEach-Object {
            $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
            if ($content -match '"(preinstall|install|postinstall)"\s*:\s*"[^"]*(curl|wget|powershell|cmd|node -e|base64|http)[^"]*"') {
                $report += [PSCustomObject]@{ Finding="Suspicious lifecycle script"; Path=$_.FullName; Detail=$Matches[0] }
            }
        }
    }
}

# 2) Scan node_modules for lifecycle hooks in installed dependencies
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Directory -Filter "node_modules" -ErrorAction SilentlyContinue | ForEach-Object {
            Get-ChildItem $_.FullName -Recurse -Filter "package.json" -Depth 2 -ErrorAction SilentlyContinue | ForEach-Object {
                $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
                if ($content -match '"(preinstall|install|postinstall)"') {
                    $report += [PSCustomObject]@{ Finding="Dependency with install hook"; Path=$_.FullName; Detail="Review package provenance" }
                }
            }
        }
    }
}

# 3) Check npm global config for ignore-scripts hardening
$npmrc = "$(npm config get globalconfig 2>$null)"
$userNpmrc = "$env:USERPROFILE\.npmrc"
foreach ($rc in @($npmrc, $userNpmrc)) {
    if ($rc -and (Test-Path $rc)) {
        $cfg = Get-Content $rc -Raw
        if ($cfg -notmatch 'ignore-scripts\s*=\s*true') {
            $report += [PSCustomObject]@{ Finding="ignore-scripts NOT enabled"; Path=$rc; Detail="Set 'ignore-scripts=true'" }
        }
    }
}

# 4) Hunt recently created executables/scripts in user-writable staging paths (last 7 days)
$stagingPaths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:TEMP")
foreach ($p in $stagingPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.js,*.vbs -ErrorAction SilentlyContinue |
      Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) -and $_.FullName -notmatch '(npm-cache|_cacache|Microsoft\\Windows)' } |
      ForEach-Object { $report += [PSCustomObject]@{ Finding="Recent executable in staging path"; Path=$_.FullName; Detail=$_.CreationTime } }
}

$report | Format-List
if ($report) { Write-Host "`n[!] $($report.Count) findings - escalate to IR if lifecycle scripts or staging artifacts are unexplained." -ForegroundColor Red }
else { Write-Host "[+] No suspicious npm lifecycle hooks or staging artifacts found." -ForegroundColor Green }