Suspicious Child Process Spawned by npm

Duo Tech@duotech

•updated Oct 17, 2025•2•0•140

Detects the Node Package Manager (npm) or npx spawning child processes commonly used to download remote files. This behavior is often seen in malicious npm packages that use post-install scripts to fetch and execute second-stage payloads, as seen with the AdaptixC2 framework delivery.