Node.js process deletes sharedLoad.min.js self-cleanup artifact

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•5

Detects instances where the Node.js runtime environment (node.exe) deletes a file named 'sharedLoad.min.js' located within a 'node_modules' directory. This behavior is indicative of anti-forensic cleanup activities where malicious npm packages attempt to remove their own footprints or temporary artifacts post-execution.