Self-Deletion After Payload Execution

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•4•0•14

Detects instances where 'node.exe' or 'node' initiates the deletion of 'setup.cjs' from the 'node_modules/easy-day-js' directory. This includes both direct file system deletion (fs.rmSync) and shell-based deletion commands (e.g., 'del /f', 'rm -f') executed by 'node.exe'. This activity is indicative of potential malicious behavior, possibly related to supply chain attacks or post-exploitation cleanup.