Node.js Spawning Python from Temporary Directory

Ethan Andrews@eandrews

•updated Feb 25, 2026•3•0•82

Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.