Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

Summary: JFrog researchers found two hijacked npm packages, uploaded on May 25, 2026 and since removed, plus 16 Go packages discovered by Nextron Systems that hide execution in a VS Code task named "eslint-check" set to run on folder open. The chain fetches encrypted JavaScript from TronGrid and Aptos blockchain transaction data, opens a Socket.io backdoor, and deploys a Python infostealer that harvests browser, wallet, password manager, Git, GitHub CLI, VS Code, OS credential store, and cloud storage data, zipping it to a C2 server or Telegram bot.
Bottom line: The stealer reaches Windows Credential Manager, macOS Keychain, KDE Wallet, and Git and GitHub CLI credentials, so a single opened project folder can hand over the developer keys that underpin your build pipeline.

Read the original at The Hacker News ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026