tasks.json is a Visual Studio Code workspace configuration file, usually stored in the .vscode directory. It defines automated tasks such as build, test, or lint commands, including which programs and arguments VS Code should run.
Because tasks can launch shells, interpreters, or other executables, a task definition may provide a path from opening a project to running code. In attacks, a repository could use a task to invoke a suspicious script or disguise a payload as an ordinary asset. The file’s presence alone does not prove that anything ran: defenders should inspect changes to .vscode/tasks.json, check what each task launches, consider workspace trust settings, and use endpoint telemetry to confirm execution.