npm/node Supply Chain Compromise - Shell Spawn with Payload Download
Detects npm or node processes spawning shell interpreters (cmd.exe, powershell.exe) during package installation, which subsequently execute download utilities (curl, wget, certutil, bitsadmin). This behavior is characteristic of malicious npm packages attempting to stage payloads during the 'preinstall' or 'postinstall' hooks.
Sigma
