A JavaScript implant is malicious JavaScript that runs on a compromised system as a loader, backdoor, or remote-control component. Unlike a one-shot script, an implant is designed to persist in memory or on disk long enough to receive commands, fetch follow-on payloads, and blend into normal software activity.
It matters because JavaScript is widely used in browsers, Node.js tooling, and automation workflows, so attackers can hide command-and-control logic inside code that may look familiar to developers. In real intrusions, a JavaScript implant may be dropped by a trojanized installer, a malicious repository, or a script-based payload chain. Defenders watch for suspicious script execution, unexpected network beacons, unsigned or altered packages, and unusual child processes spawned by JavaScript runtimes or installers.