Suspicious NPM Package Execution with Remote Script Fetch

Georg Lauenstein@gsec

•updated Mar 16, 2026•2•0•86

Detects curl or wget commands fetching scripts from vercel.app or URL shorteners and piping to shell execution, consistent with Contagious Interview initial access.