jsononifier npm dependency sandbox/CI evasion checks via node.exe under VS Code
Detects a node.exe process spawned by VS Code (Code.exe) performing sandbox/CI-CD evasion checks associated with the malicious @jaymara/jsononifier npm dependency, including a filesystem existence check for '/.dockerenv' or file access under a folder path referencing the @jaymara/jsononifier package prior to XOR-decoded payload execution.
Microsoft Sentinel (KQL)
