Node.js Copying Browser History to Temp Directory

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is associated with the 'protocal.cjs' backdoor from the easy-day-js supply chain attack, which aims to exfiltrate sensitive browser data.