Node.js execution of fake .woff2 font file as script

Ethan Andrews@eandrews

•updated Jul 2, 2026•1•0•5

Detects the execution of Node.js where the command line arguments reference a .woff2 font file. This behavior is indicative of an adversary attempting to execute a malicious payload disguised as a legitimate font file, a technique previously associated with the PolinRider campaign.