“Contagious” Code: North Korean Hackers Infiltrate Developer Workflows via Visual Studio Code

The “Contagious Interview” campaign, attributed to North Korean (DPRK) threat actors, has evolved to target developers inside their code editors and package managers, according to Jamf Threat Labs. The latest wave uses VS Code task configuration files, specifically the infection chain abuses task configuration files to silently execute malicious payloads on victim machines.

In December, researchers observed an escalation, including dictionary files containing heavily obfuscated JavaScript that run when a victim opens a malicious repository in Visual Studio Code. A previously undocumented infection method was also identified, exploiting the Node.js ecosystem to deploy code triggered by the npm install command.

The malware beacons to a C2 server every 5 seconds, can execute additional JavaScript within a child process, and can shut itself and child processes down and clean up if instructed by the attacker. Developers are urged to review repository contents before marking them as trusted in VS Code, and to scrutinise package.json, install scripts and task configuration files to avoid unintentional execution of malicious code.