npm and Go packages infected via VS Code tasks: Python infostealer and backdoor

Colleagues, I want to draw attention to a cybersecurity incident. JFrog and Nextron discovered malicious npm and Go packages that embed a hidden VS Code task (runOn: 'folderOpen') which executes JS disguised as a font file and retrieves the next stage from blockchain transactions.

Key points:
- Mechanism: autorun .vscode task deploys a socket.io backdoor and then a Python infostealer.
- Targets: Windows, Linux, macOS — theft of browser credentials, wallets, Git/VS Code artifacts and cloud data.
- Recommendations: remove suspicious packages, audit .vscode tasks, revoke and rotate tokens, passwords and keys.

Why it matters: demonstrates supply-chain weakness and risk of persistent access.

How do you protect dev environments against such supply-chain threats?
#cybersecurity #supplychain #dev #security