easy-day-js protocal.cjs Linux systemd nvmconf persistence

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation of a 'protocal.cjs' file within the '~/.config/systemd/nvmconf/' directory. This activity is associated with the 'easy-day-js' supply chain attack, where a malicious Node.js script is established as a persistent user-level systemd service named 'nvmconf'.