[Rule Tuning] Node.js Pre or Post-Install Script Execution to Cross-Platform #5402
Description
The rule Node.js Pre or Post-Install Script Execution should be converted to cross-platform for Linux and Macos to account for developer machines that may have inherited malicious 3rd-party packages or are inhertently malicious. When running npm install pre and post hooks can be configured to run arbitrary commands on an endpoint. This was recently observed with Shai-Hulud. While Linux may be a common target due to CI/CD runners, developer machines, commonly macos, were targeted as well.
