Executive Summary
Researchers have identified a sophisticated campaign involving hijacked npm and Go packages, such as `html-to-gutenberg` and `fetch-page-assets`. Unlike traditional supply chain attacks that rely on npm lifecycle scripts, this campaign uses a novel execution trigger: a hidden VS Code task configured with `runOn: "folderOpen"`. This causes malicious code, disguised as a font file, to execute automatically when a developer opens the compromised project in VS Code or similar editors like Cursor.
The attack chain leverages public blockchain infrastructure (Tron, Aptos, and Binance Smart Chain) as a resilient dead-drop mechanism to retrieve encrypted second-stage payloads. The malware eventually deploys a socket.io-based backdoor for interactive command execution and a comprehensive Python infostealer. The campaign specifically targets developers by attempting to inject code into tools like VS Code, GitHub Desktop, and the npm CLI, while also harvesting credentials, browser data, and over 30 different cryptocurrency wallet extensions.
This activity represents a significant risk to development environments, where the primary objective appears to be the theft of sensitive credentials, cloud access tokens, and digital assets. Organizations should immediately audit developer workstations for unauthorized VS Code tasks and block the associated C2 infrastructure.