A self-deleting backdoor is malicious code that removes itself after it runs, or shortly after it gains access. Its goal is to leave as little evidence as possible on the host, making detection and forensic analysis harder.
This matters in cyber security because defenders often rely on files, process traces, and memory artifacts to understand what happened. If the payload erases itself, analysts may only see indirect signs such as unusual network connections, altered logs, package history, or build and release records. In software supply-chain attacks, a self-deleting backdoor can be delivered through a trusted update or package release, execute once, and then disappear before routine scans or incident response tools collect it.