T1547
Boot or Logon Autostart Execution
discovered 2026-06-17Multi-platform persistence: macOS LaunchAgent (com.nvm.protocal.plist), Linux systemd user unit (nvmconf.service), Windows ProgramData\NodePackages, disguised as Node/nvm tooling.
View on MITRE ATT&CK