Executive Summary
In late 2026, researchers identified a sophisticated supply-chain threat targeting developers via malicious `capacitor.config.ts` files. The attack leverages the fact that many modern development frameworks execute configuration files as code during standard operations like builds or synchronizations. By embedding a 28-line loader within a legitimate-looking documentation commit, the threat actor established multiple persistence mechanisms within the repository, including automated VS Code tasks and modified npm scripts.
The technical execution is notable for its defense evasion. It retrieves a base64-encoded URL from a local environment variable (`AUTH_API_KEY`), fetches the payload via `node-fetch`, and executes it using `eval()`. To avoid detection during development, all execution errors are caught and logged as 'Auth Error!', leading developers to believe they have a credential issue rather than a malware infection. While stage-two infrastructure (files.catbox[.]moe) has been taken down, the persistence in the repository remains, allowing for easy reactivation by updating the environment variable.
This campaign highlights a critical gap in supply-chain security: the trust placed in configuration files and editor settings. Because these files reside at the repository root and are often excluded from deep code review, they serve as ideal conduits for initial access and persistence in developer environments.