VS Code (Code.exe) spawns script interpreter via auto-run task after folder open

Ibrahim Saud@tektrix

•updated Sep 22, 2026•2•0•10

Detects the spawning of script interpreters or loaders by Visual Studio Code (Code.exe) shortly after a workspace is initialized, specifically looking for command-line arguments referencing .vscode or tasks.json. This behavior is consistent with exploitation techniques where a user accepts a 'Trust Workspace' prompt, allowing malicious tasks defined in a repository's .vscode folder to execute.