From 33faa911d766580506b958be1971dfbb50f90062 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Tue, 7 Nov 2017 11:18:33 -0800
Subject: [PATCH] Add addl npm cmdlines.

---
 rules/falco_rules.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 9af00b35..3fef6de8 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -448,6 +448,7 @@
 
 - macro: parent_node_running_npm
   condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or
+              proc.pcmdline startswith "node /usr/local/nodejs/bin/npm" or
               proc.pcmdline startswith "node /opt/rh/rh-nodejs6/root/usr/bin/npm")
 
 - macro: parent_nginx_running_serf