Detached Process Second-Stage Execution

discovered 2026-06-17

setup.cjs spawns the stage-2 RAT as a detached, stdio-ignored, windowsHide child node process and unref()s it so it survives npm install exit.

Seen in packages

Campaigns