How to detect and prevent Contagious Interview IDE attacks

GitLab documents detection and prevention techniques for Contagious Interview attacks targeting VS Code IDE tasks.

• •North Korean threat actors use malicious repositories with VS Code tasks.json files to execute code when developers open the repo
• •VS Code tasks are automated via tasks.json configuration files and execute automatically on folder open without user knowledge
• •node-pty.spawn() library calls are used across VS Code to launch subprocesses, identifiable at the OS level
• •spawn-helper binary is used for background tasks without user visibility, distinguishing malicious activity from legitimate developer actions
• •EDR telemetry monitoring detects suspicious subprocess launches like curl | bash patterns running in background without user interaction