Node.js Spawns Detached Hidden Child Node Process (Loader Evasion)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

Detects instances where a parent Node.js process spawns a child Node.js process using a command line structure often associated with malicious npm packages. These packages frequently attempt to execute loader scripts in a detached or background manner to evade detection while maintaining persistence or performing malicious operations.