Apple-Signed Python and osascript Drop and Re-run JavaScript from /tmp

Duo Tech@duotech

•updated Aug 9, 2026•0•0•4

Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.