Python PoC spawning Node.js against temp .js/.json files for Brotli decoder prob

Suraj A@cytech

•updated 4 days ago•17•0•16

Detects a Python process spawning a Node.js child process that executes a JavaScript script located within a temporary directory, accompanied by a .json or .br configuration argument, matching known PoC execution patterns (such as CVE-2026-111497).