How to detect and prevent Contagious Interview IDE attacks

This post details the development of custom detection and prevention controls for IDE task-based malware distribution, specifically targeting the 'Contagious Interview' campaign. It explains how the `node-pty.spawn()` library and its `spawn-helper` binary are used by IDEs like VS Code for background task execution. The core contribution is the creation of EDR telemetry-based detections that differentiate between legitimate foreground processes and suspicious background subprocesses spawned without user interaction, specifically by monitoring `spawn-helper` calls. It also outlines proactive hardening measures such as disabling VS Code tasks globally and educating users on the risks.