Suspicious Node.js Automatic Installation

Bryant Smith@flowstate

•updated Mar 23, 2026•3•0•99

Detects the unexpected installation of Node.js by an unusual parent process (such as VS Code, cmd, or PowerShell). This behavior is indicative of the StoatWaffle downloader, which automatically fetches and installs the Node.js runtime if it is absent from the target environment.