Package Manager Install Spawns Suspicious Build-Time Execution

Ibrahim Saud@tektrix

•updated Sep 24, 2026•1•0•5

Detects the spawning of suspicious child processes (powershell, cmd, node, wscript, cscript) by dependency management utilities (npm, go, terraform). Attackers often leverage malicious packages or configurations during the build or install phase to execute arbitrary code. The rule also monitors for suspicious command-line execution patterns, such as detached 'go run' operations, which may indicate malicious activity.