Claude Code Spawns Suspicious Shell Or LOLBIN Child Process

Daniel Jeremiah@daniyyell

•updated Feb 27, 2026•1•0•38

Detects Claude Code spawning suspicious child processes, consistent with abuse of project configuration hooks or MCP initialisation commands.