How to detect and prevent Contagious Interview IDE attacks

What this post added

This post details the development of custom controls to prevent IDE task-based attacks, specifically those used by the 'Contagious Interview' threat campaign. The technical contribution involves identifying the `node-pty.spawn()` library and its `spawn-helper` binary as a key area for detection. Detections are tuned to identify background subprocesses spawned without user knowledge, distinguishing them from legitimate foreground processes. This approach aims for low-level, difficult-to-bypass detection that is effective across VS Code and its forks. Proactive measures like disabling task runs globally or educating users are also discussed.