Contagious Interview: node.exe executing disguised JS payloads (.woff2/font/image)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.