Shell Process Spawned by Node.js (Potential React2Shell Exploitation)

Detects shell or scripting processes spawned by Node.js, a potential indicator of CVE-2025-55182 (React2Shell) exploitation — an insecure deserialization vulnerability in the React Server Components Flight protocol enabling remote code execution.