Supply Chain - Package Manager Spawns Script Interpreter

Georg Lauenstein@gsec

•updated 12 days ago•0•0•25

Detects an npm or pip package installation process spawning a script interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl, wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found adversaries increasingly embed malicious setup/install scripts inside open-source packages uploaded to npm and PyPI; these scripts execute automatically the moment the package is written to disk during npm install / pip install, unless intercepted before execution. A package manager process spawning a scripting engine or download utility immediately after install is a strong indicator of an embedded malicious postinstall/setup script rather than a normal build step.