Malicious npm Package eslint-check Task Execution via VS Code folderOpen
This rule detects potentially malicious child processes spawned by Node.js or npm, as well as specific file activity related to VS Code configuration or Node module directories that may indicate supply chain or development environment tampering. It flags processes like cmd.exe, powershell.exe, or python.exe being executed by code.exe or node.exe, and monitors for modifications to tasks.json or eslint-check files within sensitive directories.
Splunk (SPL)
