Malicious VSCode tasks.json folderOpen autorun written by npm/node process

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the creation or modification of VS Code tasks.json files containing the folderOpen trigger by non-editor processes. This technique can be abused to achieve automatic code execution when a project folder is opened, a method known to be used by malicious npm packages to execute payloads disguised as benign files.