Tsundere Bot Node.js Execution

Tim Peck@timpeck

•updated Jan 28, 2026•1•0•26

Detects the execution of Node.js (node.exe) when spawned by PowerShell or the Command Prompt from a user-writable directory. This behavior is characteristic of the Tsundere Bot delivery chain used by threat actors like TA584 (Storm-0900), who use a PowerShell script to install and run the Node.js-based malware.