Malicious .vscode/tasks.json hooks can execute automatically on folder open once the workspace is trusted, running hidden background commands. This is actively abused by DPRK-affiliated groups