Socket.io Backdoor C2 via node.exe Spawned from npm or VS Code

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•8

Detects anomalous outbound network connections from node.exe processes initiated by developer tools like VS Code, npm, or installation binaries. The rule specifically monitors for patterns indicative of Command and Control (C2) communication, including high-frequency Socket.io polling, WebSocket upgrades, and long-duration connections to external, non-private IP addresses.