Malicious VSCode folderOpen Task Executes Font-Disguised Payload from Hijacked npm Package

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.