CmdID / Programs / Linux and Unix

npm

JavaScript and Node.js package manager. Manage Node.js projects and their module dependencies. Some subcommands such as install, run, etc. have their own usage documentation. tldr-pages

GTFOBins shell 1 ATT&CK technique 3 documented commands

How npm is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

exec

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-C

shell T1059.004 Command and Scripting Interpreter: Unix Shell

run

-C

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for npm.

3 documented commands

from GTFOBins, each read by CmdID

shell unprivileged, with sudo

npm exec /bin/sh

Identify

shell unprivileged, with sudo

echo '{"scripts": {"preinstall": "/bin/sh"}}' >package.json
npm -C . i

Identify

shell unprivileged, with sudo

echo '{"scripts": {"xxx": "/bin/sh"}}' >package.json
npm -C . run xxx

Identify

None of the 3 commands CmdID reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for npm. CmdID reads the line of each that runs npm.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Create a package.json file with default values (omit --yes to do it interactively)

npm init --yesIdentify

Download all the packages listed as dependencies in package.json

npm [iIdentify

Download a specific version of a package and add it to the list of dependencies in package.json

npm [i package_name@versionIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

npm

How npm is abused

3 documented commands

What detects it

Everyday use

Other programs abused for shell