node.exe Spawning cmd.exe or PowerShell from npm Package Script (Direct Embed)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects when a Node.js process spawns common command-line interpreters (e.g., cmd.exe, powershell.exe, bash) with command-line arguments indicative of potentially malicious activity. This includes common software development script names, build-related tasks, or obfuscated command execution patterns. The rule excludes processes signed by trusted publishers like Microsoft or the OpenJS Foundation.