Windows 10: is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost

JOSE ASAEL VELAZQUEZ · Jun 29, 2025 at 12:22 AM

Out of the nowhere I see this process now, node.js or node.exe I know its been only like 3 or 4 days bc I always check my processes on a daily basis. I found little information about this folder and process. The alarming part is at the same time I got this process Google sent "suspicious activity for all my gmail accounts".Could someone please help me with more information about this issue?Thank you in advance.

:)

_AW_ · Jun 29, 2025 at 12:23 AM

node,js server-side javascript? is it malware?

That's just a false positive. It's a genuine javascript runtime, though it has been used/abused by malware like Lu0bot.

Did you install the runtime?

Brink · Jun 29, 2025 at 12:23 AM

Node-ChakraCore and VM Neutrality in Node.js

Back when Node.js was launched, the device landscape was simpler, and using a single JavaScript VM helped provide Node.js the focus to grow rapidly. Today, there is a proliferation in the variety of device types, each with differing resource constraints. In this device context, we believe that enabling VM neutrality in Node.js and providing choice to developers across various device types and constraints are key steps to help the Node.js ecosystem continue to grow.
Node-ChakraCore started on this path last year by bringing Node.js to a new platform, Windows 10 IoT Core. As we chart the course for future of Node.js and promote the mission of Node.js everywhere, we’re excited to announce recent developments towards VM Neutrality, starting with Node.js API prototypes and progress towards cross-platform support in Node-ChakraCore.

The case for VM Neutrality

This growing trend of projects trying to port Node.js on to other VMs started a community discussion over whether Node.js should be VM neutral in the future, which led to this year’s VM Summit as an attempt to better understand the technical issues involved in achieving VM Neutrality.

VM Neutrality envisions Node.js as a ubiquitous application framework, highly optimized for any platform, device, or workload. It describes a state of Node.js where Node Core is neutral to the JS Engine that is powering it via open standards & APIs, enabling a more formal interface between Node.js and the VM that powers it.
In a VM-neutral world, the Node.js ecosystem, especially native modules, will continue to seamlessly work on different JS VMs optimized for a variety of different devices and workloads. The benefits of VM Neutrality are many-fold:

Reach/Ubiquity: Allows Node.js to target new devices and workloads with high optimization.

Developer Productivity: Beneficial for developers as it provides cost savings by extending the reach of Node ecosystem and its ability to reuse code to target more devices and workloads.

Standardized effort: Standardizes multi-VM efforts from already existing forks of Node.js

Node.js API (NAPI)

Node.js API (NAPI) is a community project being driven by the API working group, along with ChakraCore and others, with a goal of providing stable Node API for native module developers. NAPI aims to provide ABI compatibility guarantees across different Node versions and also across different Node VMs – allowing NAPI enabled native modules to just work across different versions and flavors of Node.js without recompilations.

NAPI is a stepping stone towards VM-Neutrality. After NAPI is officially available for native modules, it can be used inside Node core to achieve VM Neutrality and enable Node to seamlessly support multiple JavaScript engines. You can check out the first demo of a working NAPI prototype today at NodeInteractive Austin 2016!

Node-ChakraCore

In addition to supporting the NAPI efforts, Node-ChakraCore has been making progress on its cross-platform support and diagnostics innovation.

Update on Cross-platform support (Linux and macOS)

Bringing cross-platform support to Node-ChakraCore has been a key goal on our roadmap from the beginning. At NodeSummit we announced experimental support for Node-ChakraCore on Linux, and today bringing that same experimental support is available on macOS as well.

$is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost [IMG]$

Running http-server sample on macOS with Node-ChakraCore

These early experimental builds have been validated against Node.js unit tests as well as some synthetic tests. We are looking for help hardening Node-ChakraCore further, so if you run into bugs while trying out these builds, please let us know on our issues page. Performance is a work in progress, with ongoing investments in the underlying ChakraCore engine. Please stay tuned for updates in this regard from the @ChakraCore team.

Time-Travel Debugging with Reverse Continue

One of the key internal guiding principles for us involved in the Node-ChakraCore project is to bring innovation to help advance the Node.js ecosystem. In that vein, we demoed a preview of Time-Travel debugging using VSCode earlier this year. This feature allows developers to capture trace of a running Node process, and then visualize the code execution inside of VSCode by stepping back in time. The “Step Back” functionality not only allows developers to understand the code execution path but also lets them inspect the runtime context using the typical debugger UI affordances.

Today, we are happy to announce that Time-Travel Debugging in VSCode on Windows has reached the Beta milestone, with better reliability, performance and a new feature called “Reverse Continue.” This new feature is designed to work exactly like the “Debug Continue”, except that it goes backwards and is only available while debugging a TTD trace.

$is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost [IMG]$

VSCode showing Time-Travel debugging with Step Back and Reverse Continue

In addition, we are also making available a preview of Time-Travel debugging on our experimental Linux and macOS support.

Nightly Builds

The Node.js build system has now started producing nightly builds of Node-ChakraCore. Stable milestone builds will still be published on the Node-ChakraCore’s release page on GitHub.

Head over to the Node.js nightly build page and try it out.

$is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost [IMG]$

Download page on nodejs.org showing chakracore-nightly build

What’s Next?

Our main focus in the short term is to continue working with the community to advance the NAPI project and VM-Neutrality goals. We are also working on performance improvements for cross-platform scenarios. Follow @ChakraCore on Twitter to stay tuned for updates on that work.

Get involved

We always love to hear from people trying out Node-ChakraCore for their own projects. Today’s update makes it easier than ever before to get hands on with Node-ChakraCore on the platform of your choice. Take a look at the instructions to try out Node-CharkraCore and Time-Travel debugging with your existing apps and let us know if you run into problems on our issues page.

If you want to get more involved with the Node.js API efforts, here are some ways to get involved:

Convert a native module to use ABI stable APIs and report issues on conversion and performance;

Port ABI stable APIs to your fork of Node and let us know if there are gaps;

Review the roadmap and see how can you can help accelerate this project.

We’re excited to keep driving towards a VM-neutral future for the Node.js platform, and can’t wait to hear what you think!

― Arunesh Chandra, Senior Program Manager, ChakraCore
Click to expand...

Source: Node-ChakraCore and VM Neutrality in Node.js - Microsoft Edge Dev BlogMicrosoft Edge Dev Blog

_AW_ · Jun 29, 2025 at 12:23 AM

node,js server-side javascript? is it malware?

That's a genuine old node.js (2018) version.

The runtime's what you'd download from Node.js — Run JavaScript Everywhere

Where are you seeing this file, what folder? Is it part of something you have installed?

If you want to check for malware, try KVRT from Kaspersky:

Viren kostenlos entfernen – Online Virenscan | Kaspersky

Windows 10: is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost

is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost

is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost

is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost

is this malware? node.exe Node.js JavaScript Runtime - C:\Windows\System32\DomainAuthHost - Similar Threads - malware node exe

Unbalanced NUMA nodes

Unbalanced NUMA nodes

PI NODE SETTING

node,js server-side javascript? is it malware?

node,js server-side javascript? is it malware?

node,js server-side javascript? is it malware?

HOW TO REMOVECHILD NODE

HOW TO REMOVECHILD NODE

Theta Guardian Node