Security researchers have caught two hijacked npm packages and a cluster of Go packages doing something nasty: deploying a Python-based information stealer onto developer machines running Windows, Linux, or macOS.
The attack comes courtesy of JFrog’s research team. What makes it clever is how it sidesteps the usual npm execution paths. Instead of relying on lifecycle scripts, the malware hides inside a VS Code task that fires automatically when someone opens the project folder in their editor.
The packages involved are html-to-gutenberg and fetch-page-assets, both uploaded to npm on May 25, 2026. They’ve since been pulled from the registry, but anyone who installed them during that window should be concerned.
Here’s how it works. A hidden VS Code task named “eslint-check” is configured with “runOn: folderOpen” — meaning the moment you open the directory in VS Code or Cursor, the payload executes. The command disguises its malicious JavaScript as a font file. From there, the malware fetches encrypted JavaScript hidden in blockchain transaction data, connects to attacker infrastructure, opens a socket.io backdoor, and eventually drops a Python infostealer.
This isn’t new territory. The OpenSourceMalware team, tracking this under the name “Fake Font,” says this is a variant of the Contagious Interview campaign — a long-running North Korean operation targeting developers through fake job interviews. Security researcher Paul McCarty noted back in January that this campaign deploys the InvisibleFerret Python backdoor designed to steal cryptocurrency wallets and browser credentials.
The use of blockchain as a dead drop resolver is particularly annoying for defenders. The attackers rely on TronGrid and Aptos to fetch next-stage payloads, making takedown efforts significantly harder.
If you work with npm packages regularly, audit your dependencies and check for unexpected .vscode/tasks.json files. Trusting a repo isn’t the same as trusting its configuration files.
