Malicious VS Code Task with runOn:folderOpen and Hidden Payload (eslint-check)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•8

Detects the creation or modification of .vscode/tasks.json files that contain configurations designed to execute tasks automatically upon opening a folder in VS Code, specifically utilizing 'runOn': 'folderOpen' combined with visibility-hiding attributes such as 'reveal': 'never' and 'echo': false. This pattern is commonly associated with supply chain attacks where malicious payloads are hidden within project configuration files.