---
title: Suspicious Child Process of Node.js Package Manager
id: 7a4b9c1d-8e3f-4a2b-9c5d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious child processes spawned by Node.js or npm during package installation, often indicating a malicious postinstall script.
references:
  - https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npx.cmd'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts that utilize shell tools for compilation
level: high
---
title: Node.js Process with Suspicious Network Connection
id: 3e1f2a4b-5c6d-7e8f-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects Node.js processes establishing network connections to non-standard ports or suspicious remote IPs, typical of beaconing activity in supply chain compromises.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.defense_evasion
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    DestinationPort|notin:
      - '80'
      - '443'
      - '8080'
      - '3000'
      - '5000'
  condition: selection
falsepositives:
  - Development servers running on non-standard ports
level: medium

// Hunt for Node.js spawning suspicious shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "npx.cmd")
| where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FolderPath
| order by Timestamp desc


// Check for specific Axios version installation or modifications
DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName =~ "package." or FileName =~ "package-lock."
| where InitiatingProcessFileName =~ "npm.exe" or InitiatingProcessFileName =~ "node.exe"
| project Timestamp, DeviceName, ActionType, FolderPath, InitiatingProcessCommandLine
| where InitiatingProcessCommandLine contains "axios"

-- Hunt for package-lock. files modified recently to identify potential installations
SELECT FullPath, Mtime, Atime, Size
FROM glob(globs="C:/Users/**/package-lock.")
WHERE Mtime > now() - 7d

-- Hunt for Node.js processes spawning PowerShell or CMD
SELECT Parent.Name AS ParentProcess, Name, CommandLine, Pid, StartTime
FROM pslist()
WHERE Parent.Name =~ "node" AND Name IN ("powershell.exe", "cmd.exe", "pwsh.exe")

# Audit Axios package versions locally
function Check-AxiosVersion {
    param (
        [string]$Path = "."
    )
    
    $packageJson = Join-Path $Path "package."
    $lockFile = Join-Path $Path "package-lock."

    if (Test-Path $packageJson) {
        Write-Host "Checking $packageJson..."
        $ = Get-Content $packageJson | ConvertFrom-Json
        if ($.dependencies.axios) {
            Write-Host "[!] Axios dependency found: $($.dependencies.axios)" -ForegroundColor Yellow
        }
    }

    if (Test-Path $lockFile) {
        Write-Host "Analyzing $lockFile for Axios dependencies..."
        $lockContent = Get-Content $lockFile | ConvertFrom-Json
        # Navigate the lockfile structure to find axios
        if ($lockContent.dependencies.axios) {
            $version = $lockContent.dependencies.axios.version
            Write-Host "[!] Axios locked at version: $version" -ForegroundColor Yellow
            # Add logic here to compare against known bad versions
        }
    }
}

# Execute in current directory
Check-AxiosVersion