Suspicious cron.d Modification by Scripting Languages

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.