Network Tool Executed During NPM Package Install

Detect network tools being launched when an NPM package is installed. Malicious NPM packages may invoke preinstall or postinstall commands, which can involve network tools to download malicious payloads or exfiltrate sensitive information. Network tools spawned by npm, node, yarn, pnpm, bun, or related processes during package installation should be investigated. This rule complements the more generic "Launch Suspicious Network Tool in Container" rule with a specific focus on the supply chain attack vector via NPM packages.