Node.js Accessing Browser Extension LevelDB

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•3•0•13

Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.