Obfuscated Payload Execution Spawned by Package Manager - Phantom Supply Chain

Duo Tech@duotech

•updated Jul 1, 2026•5•0•11

Detects instances where common scripting or package management tools (e.g., node.exe, python.exe, pip.exe, npm.exe) launch Windows command line interpreters (powershell.exe, cmd.exe, wscript.exe, etc.) with command-line arguments indicative of potentially malicious activity, such as base64-encoded strings, command execution flags, or high-entropy command lines.