Node.js Copying Browser History to Temp Directory

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.