ProcWire Windows binary split across five npm packages

SafeDep: five npm packages published in a 12-minute burst split a
Windows binary dropper across a fake utility toolkit. The loader hid
in a preinstall hook.

Mapped techniques

T0109 Publish malicious artifact
T0151 Installation scripts

supply-chain split dropper

T0109 · Resource Development · Publish malicious artifact

Five packages in 12 minutes, one dropper split across them.

T0151 · Execution · Installation scripts

preinstall loader on Windows.

Sources

https://safedep.io/procwire-npm-windows-dropper-campaign