Miasma npm Infostealer Injection into VS Code, GitHub Desktop, and npm CLI

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects malicious code injection originating from compromised npm packages into developer tools such as Microsoft VS Code, Cursor, and GitHub Desktop, or the npm CLI. This rule monitors for suspicious process command lines involving socket.io-client, ss_eval, or axios, which are characteristic of the Miasma/Socket.io backdoor campaign.