Home-directory payload persistence

discovered 2026-06-01

Wave 3 writes the second-stage payload to ~/.emcd-vue_init.js (dot-hidden file in the user home directory) rather than os.tmpdir(). Home directories are not cleared by OS or standard cleanup tools, making this a persistence upgrade. The run-once dedup cache is also stored in the home directory (~/.emcd-vue_init/).

Seen in packages

Campaigns