npm install spawning downloader/execution chain

Ankit Mehta@Secvyn

•updated Aug 5, 2026•3•0•4

Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.