Electron Run As Node Execution

Ethan Andrews@eandrews

•updated Jun 8, 2026•2•0•3

Detects instances where node or Electron processes are executed with the ELECTRON_RUN_AS_NODE environment variable set to 1. This technique is used by UNK_DeadDrop to turn an editor into a plain Node.js interpreter for stealthy payload execution.