Malicious VSCode tasks.json with folderOpen trigger written by npm or spawning suspicious child processes

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•5

This rule detects potentially suspicious activity related to VS Code extensions or development environments, specifically targeting the creation of 'tasks.json' files by Node.js processes, or the spawning of suspicious child processes (such as shells or interpreters) by VS Code-related processes with command lines associated with common malicious patterns or unauthorized automation.