How to detect and prevent Contagious Interview IDE attacks
Contagious Interview attacks abuse VS Code’s automated tasks to execute malware when victims open a malicious repository and trust its workspace. GitLab developed low-level EDR detections around `node-pty`’s `spawn-helper`, allowing it to identify hidden background process execution while avoiding normal interactive developer activity. The article recommends combining runtime detection with IDE configuration hardening. ## The Contagious Interview Attack Path - North Korean threat actors use fake job interviews to persuade targets to download and review malicious code repositories. - Repositories can include a `.vscode/tasks.json` file configured to run automatically when the folder opens. - After the victim grants workspace trust, the task executes without obvious interaction. - Example payloads: - Detect the operating system. - Download a platform-specific second-stage payload. - Pipe it directly into `bash`, `sh`, or `cmd` using patterns such as `curl | bash`. - Resulting malware may steal passwords and cryptocurrency, deploy infostealers, and establish persistence for abuse of corporate access. ## Low-Level Detection with `spawn-helper` - GitLab looked below the VS Code layer because similar attacks can affect VS Code forks and other Node- or Electron-based IDEs. - VS Code uses the popular `node-pty` library to launch subprocesses. - `node-pty.spawn()` invokes a `spawn-helper` binary, which becomes a child process of the Node application. - This makes `spawn-helper` a useful operating-system-level signal for background task execution. ## Reducing False Positives - GitLab used Purple Team exercises to reproduce the attack and reviewed EDR telemetry. - Background VS Code tasks use `spawn-helper`, while foreground interactive processes such as the integrated terminal use a Code Helper binary. - Detections can therefore focus on processes launched invisibly, without user interaction. - GitLab further tuned alerts to identify suspicious commands such as background `curl | <shell>` execution rather than flagging every automated task. - The resulting detection produced no false positives despite widespread VS Code usage internally. ## Additional Prevention Measures - Runtime EDR monitoring is only one layer of defense. - Organizations can proactively harden their fleets by deploying global VS Code configuration that disables automatic task execution. - Combining IDE restrictions with process telemetry and behavioral detection provides broader protection against malicious repository-based attacks. Organizations should disable automatic task runs where practical and monitor low-level subprocess behavior, especially invisible `spawn-helper` executions that download or pipe remote content into a shell.
Read original(opens in new tab)
