How Malware Abuses NPM Lifecycle Scripts and VS Code Tasks

This blog analyzes how threat actors weaponize npm lifecycle scripts and VS Code tasks to convert routine developer actions (npm install, opening a folder) into silent code execution, documents multiple real-world compromises (e.g., Bitwarden CLI, Axios, Nx) and large-scale campaigns (Lazarus Group, TasksJacker, PolinRider, Mini Shai-Hulud), describes resulting payloads (infostealers, cross‑platform RATs, backdoors) and outlines actionable mitigations such as disabling lifecycle scripts by default, using package-manager controls (pnpm, --ignore-scripts, --allow-git settings), and turning off VS Code automatic tasks.