T1547

Boot or Logon Autostart Execution

discovered 2026-06-17

Multi-platform persistence: macOS LaunchAgent (com.nvm.protocal.plist), Linux systemd user unit (nvmconf.service), Windows ProgramData\NodePackages, disguised as Node/nvm tooling.

View on MITRE ATT&CK

Seen in packages

Campaigns