A .woff2 file uses the Web Open Font Format 2, a compressed format for delivering fonts to websites. Because the extension suggests ordinary font data, attackers may use it to disguise other content. The filename alone does not establish that a file is a valid font or safe to open.
In attacks, a disguised file may be placed in a project alongside configuration that runs code, such as a VS Code task. The file may serve as camouflage or as part of a payload chain; its presence alone does not prove that code executed or data was stolen. Defenders should check suspicious files with trusted analysis tools, review repository task and workflow configuration, and avoid triggering unfamiliar project tasks. Validate file contents rather than relying only on the extension.