JSCeal Node.js Installed Application Enumeration via listInstalledApplications

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects Node.js or Electron processes executing a command to list installed applications while originating from or residing within suspicious, writable directories such as Temp, AppData, or Public folders, which is a common pattern for reconnaissance by malicious software or droppers.