Lazarus Contagious Interview: VS Code Task Auto-Exec with Git/npm Precursor

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects instances where the Visual Studio Code process (code.exe) spawns shell or scripting interpreters (such as cmd.exe, powershell.exe, python.exe, etc.) to execute commands involving sensitive file paths, development configuration files, or suspicious keywords, specifically within a short duration (5 minutes) after Git or NPM activity has occurred on the same host. This pattern may indicate exploitation or unauthorized code execution triggered through a compromised or malicious development environment.