ChainScript bundled Node.js runtime executing from non-standard path

Ibrahim Saud@tektrix

•updated Sep 21, 2026•2•0•5

Detects instances of node.exe being spawned by potentially suspicious parent processes like msiexec.exe, wscript.exe, cscript.exe, or explorer.exe, or being executed from unusual locations often associated with malicious staging or masquerading, such as Windows Libraries or Themes directories.