--- title: Contagious Interview turns VS Code into an attack vector description: The Contagious Interview campaign has evolved to weaponize VS Code by embedding malicious code in tasks.json configuration files. When developers open and... canonical: https://daily.dev/posts/contagious-interview-turns-vs-code-into-an-attack-vector-vnimsxfaf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Contagious Interview turns VS Code into an attack vector | daily.dev og:description: The Contagious Interview campaign has evolved to weaponize VS Code by embedding malicious code in tasks.json configuration files. When developers open and... og:url: https://daily.dev/posts/contagious-interview-turns-vs-code-into-an-attack-vector-vnimsxfaf og:image: https://api.daily.dev/og/posts/vNimSxfaF.png og:image:alt: Contagious Interview turns VS Code into an attack vector og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Contagious Interview turns VS Code into an attack vector **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments ## Summary The Contagious Interview campaign has evolved to weaponize VS Code by embedding malicious code in tasks.json configuration files. When developers open and trust a repository, hidden commands automatically execute JavaScript payloads from remote servers, establishing persistent backdoors. Attackers use social engineering tactics like fake interview assignments to trick developers into cloning malicious Git repositories. The backdoor persists even after VS Code is closed, and attackers often host payloads on legitimate platforms like Vercel to evade detection. Security researchers recommend carefully reviewing repository contents before marking them as trusted and vetting package.json files before running npm install. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Your IDE is an Attack Vector](https://daily.dev/posts/your-ide-is-an-attack-vector-6mrqzzvv0) · DEV · 1 upvotes · 0 comments - [No Click, No Run — Automatic Malware Execution Hidden in a VSCode Project](https://daily.dev/posts/no-click-no-run-automatic-malware-execution-hidden-in-a-vscode-project-feas3i6zu) · Coins Bench · 0 upvotes · 0 comments - [Contagious Interview malware in SVG images: DPRK campaign — Elastic Security Labs](https://daily.dev/posts/contagious-interview-malware-in-svg-images-dprk-campaign-elastic-security-labs-fowc488dv) · Elastic Security Labs · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/contagious-interview-turns-vs-code-into-an-attack-vector-vnimsxfaf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Contagious Interview turns VS Code into an attack vector","url":"https://daily.dev/posts/contagious-interview-turns-vs-code-into-an-attack-vector-vnimsxfaf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/contagious-interview-turns-vs-code-into-an-attack-vector-vnimsxfaf"},"datePublished":"2026-01-21T12:34:59.197Z","dateModified":"2026-02-28T04:26:45.694Z","description":"The Contagious Interview campaign has evolved to weaponize VS Code by embedding malicious code in tasks.json configuration files. When developers open and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e9ad568dfd8592602e022be98eebb63c?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e9ad568dfd8592602e022be98eebb63c?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/contagious-interview-turns-vs-code-into-an-attack-vector-vnimsxfaf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nodejs,malware,vscode","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Contagious Interview turns VS Code into an attack vector"}]} ```