Recon Command Spawned from mrmustard-Linked Parent Process

Duo Tech@duotech

•updated Jul 24, 2026•1•0•4

Detects host reconnaissance commands (e.g., pip freeze, id, hostname -I) spawned by processes whose command line references the malicious 'mrmustard' Python package. This links discovery activity directly to the context of the supply chain compromise.