Malicious VS Code tasks.json Auto-Execution on Folder Open

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects instances where VS Code (Code.exe) spawns interpreter processes (node, python, cmd, powershell, sh, bash) after opening a workspace containing a suspicious tasks.json file. This pattern is consistent with the abuse of VS Code task automation features to gain initial code execution, similar to campaigns targeting developers through malicious repository cloning.