Lazarus Contagious Interview: npm/node.exe Spawning Suspicious Child Processes via Hijacked Packages

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potentially malicious activity where 'npm' or 'node' processes spawn sensitive child processes (e.g., cmd.exe, powershell.exe, python.exe, curl.exe) in contexts associated with package installation (e.g., node_modules, postinstall scripts) or known indicators of compromise related to supply chain attacks and credential theft.