NPM/Node process spawning Python interpreter (BeaverTail→InvisibleFerret chain)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects instances where node.exe or npm processes spawn a Python interpreter. This behavior is indicative of malicious activity, specifically the execution of second-stage payloads such as the InvisibleFerret backdoor often associated with the BeaverTail JavaScript loader, observed in software supply chain compromise campaigns.