Poisoned .claude/index.js in Go Repositories Executing node via VS Code Tasks
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Splunk (SPL)
