VS Code tasks.json auto-execution or temp_auto_push.bat repo-tampering script execution

Emiliano Mema@Nosalva

•updated Jul 16, 2026•4•0•7

This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.