easy-day-js protocal.cjs backdoor C2 beacon

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•14

This rule detects network communication to a known command and control (C2) server (23.254.164.123:443) associated with the 'protocal.cjs' backdoor, which is part of the 'easy-day-js' npm supply chain compromise. The detection specifically looks for TLS traffic with a Server Name Indication (SNI) and general IP traffic to this C2 address.