MCP Server Process Spawned by npm or pip Package Install (Typosquatting)
Detects the spawning of potential Model Context Protocol (MCP) server processes immediately following or by package installation commands (npm, pip). This behavior is characteristic of malicious packages or typosquatted dependencies attempting to register or execute a malicious MCP server configuration upon installation in a developer environment.
Microsoft Sentinel (KQL)
