PowerShell downloads/extracts node.zip and build.zip (JSCeal staging)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects a suspicious sequence of activities where PowerShell downloads or extracts specific zip files (node.zip, build.zip) to staging directories, followed by the execution of associated binaries like node.exe, winpty-agent.exe, or winpty.dll from those same locations. This behavior is indicative of an adversary staging and executing tooling within temporary user directories.