Fake Font: Malicious npm and Go Packages Disguised as Font Files

A cluster of malicious packages that use fake .woff2 font files to conceal JavaScript payloads. Tactically overlaps with TaskJacker and PolinRider, using VS Code auto-run tasks for execution.