A Node.js backdoor is malicious JavaScript or compiled code designed to run inside the Node.js runtime and give an attacker hidden access to a system. Because Node.js is widely used for build tools, APIs, and developer utilities, a backdoor can inherit the same permissions as the application or CI job that loads it. That makes it useful for stealing secrets, downloading more payloads, or creating remote command access.
In real attacks, a Node.js backdoor often arrives through a compromised npm package, a poisoned release, or a dependency used in a build pipeline. It may read environment variables, exfiltrate tokens, modify files, or execute shell commands during install or runtime. Defenders look for package provenance, dependency review, locked versions, and least-privilege execution. Secret rotation and malware scanning matter because Node.js backdoors frequently target credentials and automation systems rather than just end-user machines.