VSCode npm Infostealer Sandbox Evasion via vscode-eioesocxetd.js Environment Check

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•9

Detects the execution of the VSCode npm infostealer campaign, specifically identifying the usage of a fake eslint loader named 'vscode-eioesocxetd.js'. This malware performs sandbox and environment checks for CI/CD, cloud, and containerized environments (AWS, Azure, GCP, GitHub Codespaces, etc.) to evade analysis before proceeding to deploy infostealers or backdoors.