Axios NPM Supply Chain Attack - Script Interpreter Spawn from npm Lifecycle
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains).
Microsoft Sentinel (KQL)

