Node.js Single Executable Application Packaging
discovered 2026-05-28Malware payload bundled as a Node.js SEA (Single Executable Application), producing a standalone binary (81 MB) that embeds the Node.js v20.18.2 runtime. Avoids dependency on victim having Node.js installed and obscures the JavaScript payload within a stripped ELF/PE binary.
