Malicious VSCode Task runOn:folderOpen Executing Node via Font-Disguised Payload

Ethan Andrews@eandrews

•updated Jun 25, 2026•3•0•11

Detects suspicious execution of Node.js processes initiated by VS Code (or Cursor) that appear to be running JavaScript payloads disguised as font files (.woff2) or other suspicious assets. It also monitors for the creation or modification of '.vscode/tasks.json' files by package managers or source control tools, which could indicate the configuration of malicious 'folderOpen' tasks used for persistence or automated execution upon workspace opening.