Lunar Client Modrinth Supply-Chain: Unexpected Child Process Spawned by Java

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•0

Detects anomalous child process creation from the Lunar Minecraft Client or its associated Java processes (java.exe/javaw.exe). This rule identifies potential supply-chain exploitation, where malicious mods or the client itself spawn shell interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) or other suspicious binaries from the application's directory, which is characteristic of the lunar-modrinth-chain-poc exploit.