Malicious npm Global require Hook Injection via _V Marker and vscode-eioesocxetd.js

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the execution of a malicious Node.js process using a fake ESLint loader named 'vscode-eioesocxetd.js'. This malware persists by modifying the global 'require' function and setting the 'global['!']' property to ensure its presence across process restarts, typically masquerading within npm package directories.