Skip to content

Back to the catalog

VSCode Lifecycle Script Malware
opensourcemalware.comwriteup

VSCode Lifecycle Script Malware

Explains how npm's preinstall/install/postinstall lifecycle scripts and VS Code's tasks.json "runOn": "folderOpen" setting (paired with reveal:never/echo:false to suppress output) are exploited by threat actors as silent code-execution triggers requiring no user action beyond routine developer workflows like npm install or opening a project folder. Covers why this bypasses reachability-based defenses since malware "goes boom without a path," and walks through real npm attack campaign examples including one referencing Bitward.

TL;DR Deep dive into how malware weaponizes npm lifecycle scripts and VS Code's tasks.json auto-execution to trigger silent code execution during normal dev workflows.
Open original ↗

Organisations named here

  • Bitward

Technologies named here

  • Bitwarden CLI
  • OpenSourceMalware
  • Bun JavaScript runtime
  • EDR
  • axios
  • Internal registries
  • plain-crypto-js
  • pnpm
  • Nx
  • VS Code
  • OWASP NPM Security Best Practices guide
  • tailwind-autoanimation
  • Koi Security
  • npm CLI
  • GitHub
  • node-gyp
  • Yarn
  • SAP CAP packages
  • pnpm v10+
  • npm
  • Visual Studio Code
  • Node.js

Techniques named here

  • npm lifecycle script abuse
  • VS Code tasks.json auto-execution
  • Payload hidden in non-code file
  • Fallback payload in disguised file
  • Git history rewriting
  • Fetching payload from allow-listed legitimate source
  • Fake .npmrc replacing git binary
  • npm dependency confusion via added transitive dependency
  • Credential/secret harvesting via AI tool permissions

Threat actors named here

  • Lazarus Group
  • Contagious Interview
  • TasksJacker
  • PolinRider
  • TeamPCP
  • Mini Shai-Hulud
  • s1ngularity attack
  • Fake Font campaign
  • Malicious Dictionary campaign
  • BeaverTail
  • InvisibleFerret
  • Bitwarden CLI compromise
  • Axios compromise

Related in Supply Chain