@vscode/deviceid

Named by 2 kept items in this workspace.

Search every workspace for @vscode/deviceid. It matches the name as written, so it can find other things that share it.

The items that name it 2

Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
writeup2026-09-20
Module inside VS Code, Cursor, and Antigravity targeted for self-reloading persistence injection by the final RAT payload.
Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
writeup2026-07-30
module used by VS Code, Cursor, and Antigravity; targeted for persistence injection (path: .../resources/app/node_modules/@vscode/deviceid/dist/index.js)

All technologies in this workspace.