Suspicious Node.js Child Processes

Kaung Khant Ko@kaungkhantko

•updated May 27, 2026•1•0•118

Detects instances where the Node.js runtime (node.exe) acts as a parent process to command shells or known sideloading executables observed in the Seedworm campaign.