Malicious Supply Chain Package Execution - Scripting Engine Spawning Shell

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•5

This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.