Sapphire Sleet - Node.js TLS Verification Bypass

Georg Lauenstein@gsec

•updated Jun 21, 2026•1•0•8

Detects Node.js processes launched with TLS certificate verification disabled via NODE_TLS_REJECT_UNAUTHORIZED=0. The Sapphire Sleet easy-day-js dropper uses this technique to establish C2 communication without certificate validation.