WaterPlum Loader Pattern: Encoded/Hidden Download Commands via Node/VSCode

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•7

Detects suspicious command-line patterns typically used for downloading or executing malicious payloads, such as curl, base64 encoding, and PowerShell web requests, when spawned directly from Node.js or Visual Studio Code processes. This behavior is associated with supply chain compromises and loader activity (e.g., WaterPlum/Contagious Interview) targeting development environments.