InvisibleFerret Python Backdoor Spawned from npm or Node.js Parent Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the spawning of a Python interpreter process by npm or node.js parent processes where the Python command line involves directories typically used for temporary files or staging (e.g., AppData, Temp). This behavior is consistent with the execution of the InvisibleFerret multi-stage backdoor, often delivered via malicious packages in developer environments.