Gradle preBuild Task Spawning Shell via ProcessBuilder

Nate Dunning@nateossprey

•updated Sep 9, 2026•1•0•2

Detects instances where the Gradle or Gradlew build process launches a shell command, which may indicate a malicious build hook or dependency-based execution of arbitrary code within the software supply chain.