Suspicious Child Process Spawned by npm or go get Package Install

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects when package management tools like npm or go get spawn suspicious child processes, such as interpreters (python, powershell, cmd, bash) or utility binaries (mshta, wscript), during the installation lifecycle. This behavior is indicative of malicious code execution triggered by compromised or hijacked software packages.