A Node.js implant is malicious JavaScript code that runs inside the Node.js runtime. Attackers use it because Node.js is common on developer laptops, build servers, and CI systems, where it can access files, processes, and network resources with the same permissions as the host account. Once executed, an implant may enumerate directories, read configuration files, parse environment variables, and look for secrets such as API tokens, SSH keys, wallet data, or browser and messaging sessions.
In supply-chain attacks, a Node.js implant is often delivered as a second stage after a seemingly harmless package or installer runs. This keeps the initial payload small and harder to inspect while shifting the real theft logic into fetched code. Defenders look for unexpected outbound requests during installs, unusual file access in Node.js processes, and package scripts that execute without a clear business need. Limiting secrets on build machines and reviewing dependency behavior helps reduce the impact.