npm OR pip install → Newly-Registered-Domain beacon

Peter Czajkowski@det0x

•updated Jun 20, 2026•0•0•8

A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).