Node.js Copying Browser History to Temp Directory

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•3

Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.