Node.js hidden child process followed by Slack/Telegram beacon (host fingerprint

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•4

Detects a suspicious Node.js process pattern characterized by the execution of 'sharedLoad.min.js' or detached child processes, followed by rapid outbound network communication to known messaging platforms (Slack, Telegram). This behavior is indicative of the indexed-btree malware family, which exfiltrates host fingerprint data including architecture, hostname, and system metrics.