Suspicious Child Process Spawned by Node.js

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious child processes spawned by Node.js that could indicate compromised npm packages or malicious scripts. Malicious packages often use install/preinstall scripts to execute unauthorized system commands through these child processes. Investigate immediately as this may indicate package compromise or malicious code execution.

2025-11-21 00:00:00

None

4d2551f4-007e-4034-a532-13fc34157c3d

attack.execution attack.initial-access attack.t1059.007 attack.t1195.002

Nextron Sigma feed only (private)