Node.js Copying Browser History to Temp Directories

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•18•0•40

Detects instances where 'node.exe' is observed copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.