diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 89a1eae1996..523e63edea2 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -222,7 +222,7 @@
 # The truncated dpkg-preconfigu is intentional, process names are
 # truncated at the falcosecurity-libs level.
 - list: package_mgmt_binaries
-  items: [rpm_binaries, deb_binaries, update-alternat, gem, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd]
+  items: [rpm_binaries, deb_binaries, update-alternat, gem, npm, pip, pip3, sane-utils.post, alternatives, chef-client, apk, snapd]
 
 - macro: package_mgmt_procs
   condition: proc.name in (package_mgmt_binaries)