'Contagious Interview' Attack Now Delivers Backdoor Via VS Code

Jamf Threat Labs identified a new delivery technique used by the North Korean 'Contagious Interview' campaign in which malicious Git repositories (presented as hiring/code-review exercises) abuse Visual Studio Code's trust/configuration processing to automatically run commands that download and execute a JavaScript backdoor via Node.js. The payload persists and runs invisibly on macOS developer systems even after VS Code is closed, enabling credential and data theft; the campaign targets developers in high-value areas such as blockchain and cryptocurrency and leverages social engineering on platforms like LinkedIn. Jamf recommends carefully vetting repository contents before marking them as trusted and avoiding running unvetted 'npm install' or install scripts.