• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Suspicious Node.js or NPM Execution Activity

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Sunil Chikkala@Sunil2652000
    •updated 5 days ago•1•0•3

    Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.

    CQL

    Tags

    T1195.001 - Compromise Software Dependencies and Development ToolsTA0001 - Initial AccessProcess CreationCommand ExecutionScript ExecutionWindowsLinuxmacOSCrowdstrike Falcon EDR

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?