Malicious Npm And Go Packages Steal Sensitive Data
A recent cybersecurity threat has been discovered where hijacked npm and Go packages are being used to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. The attack avoids common npm execution paths and instead uses a hidden Microsoft Visual Studio Code task — named eslint-check to masquerade as a linter — to trigger the execution of arbitrary code. This task is configured with "runOn": "folderOpen", so it runs automatically when the project folder is opened as a trusted workspace in an IDE like VS Code. The two identified npm packages, html-to-gutenberg (v4.2.11) and fetch-page-assets (v1.2.9), were uploaded to npm on May 25, 2026. The packages were designed to retrieve encrypted JavaScript from blockchain transaction data, connect to attacker-controlled infrastructure, launch a socket.io backdoor, and eventually deploy a Python infostealer.
The technical explanation of the attack vector reveals that the malware disguises itself as a font file, specifically public/fonts/fa-solid-400.woff2, which contains JavaScript code padded with 752 space characters so it appears empty in a text editor without word wrap. The bogus font file uses blockchain infrastructure as a dead drop resolver, relying primarily on TronGrid with Aptos as a fallback, and additionally BSC JSON-RPC, to fetch a next-stage JavaScript payload. The payload is extracted after a ?.? marker in the transaction input and XOR-decoded before execution via eval or detached Node processes. The JavaScript stage repeats the same dead drop retrieval pattern to configure a command-and-control server that enables file uploads and Python malware delivery. The socket.io backdoor registers victims and accepts commands for shell execution, clipboard access, and file uploads, and also injects into VS Code, Cursor, Discord, GitHub Desktop, and the npm CLI.
The implications of this threat are significant, as it highlights the vulnerability of software supply chains to malicious attacks. The fact that the attackers were able to hijack legitimate npm and Go packages and use them to deploy malware is a concern for developers and users alike. The campaign has also targeted the Go ecosystem, with 16 additional packages containing the same malware. Users who have installed the packages are advised to remove them immediately and take steps to secure their systems. The attack surface is broad, and the potential consequences of this threat are severe, including the theft of sensitive data — browser credentials, cryptocurrency wallets, password managers, SSH keys, and cloud API keys — compromise of systems, and disruption of business operations. It is essential for developers and users to be aware of this threat and take proactive measures to protect themselves.
Attack Surface
Endpoint, Supply Chain (Third-party vendors)
Tactics
Initial Access, Execution, Persistence, Exfiltration
Techniques
- T1190 – Spearphishing via Service
SuperPRO's Threat Countermeasures Procedures
- Remove the identified npm packages, html-to-gutenberg and fetch-page-assets, from your system (npm uninstall html-to-gutenberg fetch-page-assets)
- Search developer machines for hidden VS Code folder-open tasks , specifically .vscode/tasks.json files containing "runOn": "folderOpen" — and remove them.
- Remove dropped artifacts such as ~/.node_modules, the downloaded Python runtime, and npm cache archives.
- Block known C2 infrastructure at the network level (166.88.134.62, 198.105.127.210, 23.27.202.27).
- Rotate credentials, tokens, cloud credentials, API keys, browser-stored credentials, and wallet credentials. Treat any affected machine as fully compromised.
- Upgrade to the latest version of npm and Go to ensure you have the latest security patches.
- Use a reputable security solution to monitor for suspicious activity and detect potential threats.
- Implement secure coding practices to prevent similar attacks in the future.
- Regularly review and update your dependencies to prevent exploitation of known vulnerabilities.