easy-day-js setup.cjs drops .pkg_history and .pkg_logs infection markers in tmpdir

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.