GHAPPIER: npm install spawns node.exe with outbound network callout

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•4

Detects instances where npm.exe or node.exe initiate child node.exe processes, a behavior commonly associated with multi-stage loaders or malicious packages (e.g., GHAPPIER) that execute arbitrary JavaScript payloads during package installation or execution.