Claude Code AI Agent Spawning Suspicious Shell/Setup Script Child Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects instances where Claude AI-related processes (claude, claude-code) or Node.js processes associated with Claude launch suspicious commands or scripts such as setup scripts, base64-encoded commands, shell interactions, or external network connections. This behavior is indicative of potential supply chain compromise or malicious use of AI-assisted coding tools to execute arbitrary system operations.