Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. The attack avoids common npm execution paths through lifecycle scripts, possibly to remain compatible with npm v12’s security hardenings. The packages hide execution inside a VS Code task, configured to run automatically when the project folder is opened in VS Code. From there, the malware retrieves encrypted JavaScript from blockchain transaction data, connects to attacker-controlled infrastructure, launches a socket.io backdoor, and eventually deploys a Python infostealer.

The identified npm packages are html-to-gutenberg and fetch-page-assets (which lists html-to-gutenberg as a dependency). They were uploaded to npm on May 25, 2026, and are no longer available. The attack starts with a hidden VS Code task named “eslint-check” that triggers arbitrary code execution when the folder is opened as a workspace. The command disguises the payload as a font file (public/fonts/fa-solid-400.woff2) containing JavaScript code.

This abuse of VS Code auto-run tasks, coupled with disguising JavaScript malware as font files, has been attributed to North Korea. The OpenSourceMalware team tracks this activity under the moniker Fake Font, describing it as a variant of Contagious Interview, a long-running campaign targeting software developers through fraudulent job interviews. The Fake Font campaign delivers a multi-stage loader that deploys the InvisibleFerret Python backdoor, designed to steal cryptocurrency wallets, browser credentials, and establish persistent access.

The bogus font file uses blockchain infrastructure as a dead drop resolver, relying on TronGrid and Aptos to fetch a next-stage JavaScript payload. The JavaScript stage configures a command-and-control server enabling file uploads and Python malware delivery, including a Socket.io backdoor for remote control. The infection chain launches a Python loader that retrieves the Python infostealer from the C2 server. The artifact is a wide-ranging credential, browser, wallet, and developer artifact stealer that can siphon data from Chromium-based and Mozilla Firefox browsers, password managers, authenticators, and cryptocurrency wallets. It also harvests developer-oriented information like Git credentials, GitHub CLI hosts.yml, GitHub Desktop logs, VS Code, and global storage, as well as data from Windows Credential Manager, Linux Secret Service, KDE Wallet, macOS Keychain, and cloud storage metadata for Dropbox, Google Drive, Microsoft OneDrive, Apple iCloud, Box, Mega, and pCloud.

The campaign has also targeted the Go ecosystem, with Nextron Systems discovering 16 Go packages containing the same malware. Users who have installed the packages are advised to remove them immediately, search developer machines for hidden VS Code folder-open tasks, and rotate credentials, tokens, cloud credentials, API keys, browser-stored credentials, and wallet credentials.