Miasma: VS Code Task Runner Spawning Node.js from Hidden NodeJS Persistence Path

Duo Tech@duotech

•updated Jul 15, 2026•0•0•1

Detects the execution of Node.js processes launched by VS Code (via task runner) that reference known Miasma malware persistence paths (e.g., sync.js in hidden NodeJS directories across Windows, Linux, or macOS).