Supply Chain Abuse: npm/pip/nuget Spawning Suspicious Child Process (T1195.001)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects when common package management tools (npm, pip, nuget, python) spawn potentially malicious child processes such as cmd.exe, powershell.exe, curl.exe, or certutil.exe. This activity is a classic indicator of supply chain attacks where a compromised dependency or installation hook attempts to execute arbitrary commands or download secondary payloads on a developer or build machine.