Node.js detached child process with inline eval for C2 bootstrap via npm infostealer

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•5

Detects Node.js processes launched via command line with potentially obfuscated or malicious code patterns. This includes the use of eval-like flags combined with JavaScript memory management or network-related library imports, as well as command lines containing unusually long hex-encoded strings or base64-encoded blocks often used by attackers to hide payloads.