macOS LaunchAgent persistence via com.nvm.protocal.plist

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•2•0•15

Detects the creation or modification of specific malicious macOS LaunchAgent plist files (com.nvm.protocal.plist) or payload files (protocal.cjs) within the NodePackages directory, indicative of the easy-day-js backdoor establishing persistence.