Node.js Process Spawns Child Node Process for Host Fingerprinting

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

Detects instances where a Node.js process spawns another Node.js process as a child. This behavior is often associated with malicious npm packages attempting to evade detection during runtime execution or executing secondary malicious payloads.