VS Code tasks.json hidden runOn:folderOpen task auto-executes non-JS file

Ethan Andrews@eandrews

•updated Jul 2, 2026•1•0•6

Detects the creation or modification of a .vscode/tasks.json file, followed by the execution of a process (specifically node.exe) that targets a script file without a standard JavaScript extension (.js, .mjs, .cjs). This behavior is consistent with an adversary configuring a hidden VS Code task (e.g., using 'hide:true' and 'runOn:folderOpen') to silently execute arbitrary code or assets when a project folder is opened.