node.exe C2 Download and Shell Staging During npm Package Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects potential command and control (C2) activity from node.exe to known malicious domains associated with the Polymarket Trap / wshu.net campaign. Additionally, it monitors for suspicious child process spawning by node.exe, including usage of downloader utilities (curl, wget, PowerShell) or execution of downloaded scripts/archives (npm, .tgz files) indicative of malicious post-exploitation activity.