Node.js process spawning shell child (CVE-2026-111497 RCE behaviour)

ills3c Intel&Coffee@Ills3C

•updated today•11•0•19

Detects behavior where a Node.js process spawns a command shell or interpreter (such as sh, bash, cmd.exe, or powershell.exe) executing suspicious commands indicative of remote code execution (RCE), reverse shells, or payload downloading, consistent with vulnerabilities like the Node.js decompression flaw CVE-2026-111497.