~/.local/share/NodeJS/sync.js

discovered 2026-07-14

Linux drop path for the Stage-2 RAT persistence payload. macOS: ~/Library/Application Support/NodeJS/sync.js. Windows: %LOCALAPPDATA%\NodeJS\sync.js.

~/.local/share/NodeJS/sync.js — IOC — SafeDep Threat Intelligence - Real-time Open Source Software Supply Chain Security