This is based on SIGUSR1, so means you need to run as the same user on the same local system, but it can be used for interesting techniques like extending node.js/electron based applications beyond what they were designed for.
[Wayback/Archive] evilsocket/jscythe: Abuse the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code.
The behaviour has been documented and was known for a long time: [Wayback/Archive] sigusr1 node.js – Twitter Search.
It got my attention because ofย [Wayback/Archive] Simone Margaritelli on Twitter: “You can force any v8/Electron process to execute arbitrary js code (child_process, http, etc) by forcefully enabling and abusing the builtin debug mechanism … here’s VS Code executing Calc, but I suspect any Electron app is susceptible ๐ฅ it works with SIP enabled on macOS”





