VS Code Infostealer Attack — Why It Matters

A newly uncovered software supply chain campaign has revealed how attackers are abusing trusted open-source ecosystems to compromise developers. According to security researchers at JFrog, the VS Code Infostealer Attack leverages hijacked npm packages and compromised Go packages to silently deploy a multi-stage Python information stealer across Windows, Linux, and macOS.

A newly uncovered software supply chain campaign has revealed how attackers are abusing trusted npm packages to compromise developers. Unlike traditional npm malware that relies on installation scripts, this campaign introduces a stealthier approach by exploiting Visual Studio Code’s automatic task execution. Simply opening an affected project folder in VS Code or compatible IDEs can trigger malicious code execution without requiring developers to manually run any commands.

The discovery highlights the growing sophistication of software supply chain attacks and reinforces the need for developers to carefully audit third-party dependencies before integrating them into production environments.

What Is Visual Studio Code?

Visual Studio Code (VS Code) is Microsoft’s widely used source-code editor that supports extensions, integrated terminals, debugging tools, and project automation through configuration files.

One of these features allows projects to define workspace-specific tasks inside a .vscode/tasks.json file. While intended to automate development workflows, attackers abused this functionality to execute malware automatically whenever a trusted project folder is opened.

What Caused the Incident?

According to JFrog’s security research, attackers hijacked two npm packages:

• html-to-gutenberg
• fetch-page-assets

Researchers also identified 16 malicious Go packages spreading the same infection chain.

Instead of using commonly monitored npm lifecycle scripts, the attackers embedded obfuscated JavaScript inside a fake .woff2 font file.

The malicious packages then:

• Decode hidden JavaScript
• Retrieve encrypted payloads
• Create hidden VS Code tasks
• Deploy a Socket.IO backdoor
• Download a Python-based infostealer

The campaign also relied on TronGrid and Aptos blockchain transactions as resilient dead-drop infrastructure, making command retrieval significantly harder to disrupt.

VS Code Infostealer Attack: Full Technical Breakdown

Timeline of Events

1. Developer installs compromised npm or Go package.
2. Hidden JavaScript is extracted from a fake font file.
3. Payload locations are retrieved through blockchain transactions.
4. A hidden .vscode/tasks.json file is generated.
5. The task named eslint-check is configured with:

runOn: "folderOpen"

6. Opening the project inside VS Code automatically executes malware.
7. Socket.IO backdoor establishes communication.
8. Python infostealer is downloaded.
9. Sensitive developer data is stolen.

What Data and Systems Were Affected?

Researchers found the malware capable of stealing:

• Browser credentials
• Saved passwords
• Cryptocurrency wallets
• Git credentials
• VS Code artifacts
• Cloud storage metadata
• Environment variables
• API keys
• Operating system secrets
• Password manager databases

Affected operating systems include:

• Windows
• Linux
• macOS

Potential Risks & Impact

Identity and Financial Risks

Developers often store sensitive credentials locally for convenience. Theft of these credentials may allow attackers to compromise:

• GitHub repositories
• Cloud environments
• Cryptocurrency wallets
• Password managers
• Enterprise developer accounts

This could eventually lead to additional supply chain compromises.

Business Risks

Organizations relying on open-source dependencies face significant risks when compromised packages enter production pipelines.

Possible impacts include:

• Source code theft
• Intellectual property loss
• Unauthorized infrastructure access
• Production compromise
• CI/CD pipeline abuse

Regulatory and Compliance Risks

Organizations affected by stolen credentials may need to investigate whether customer or internal data was exposed.

Depending on jurisdiction, compromised organizations could face compliance obligations under regulations governing data protection and incident reporting.

Official Response

JFrog researchers disclosed the campaign after identifying the malicious packages and documenting the complete attack chain.

Researchers emphasized that this campaign avoids traditional npm execution mechanisms, making detection considerably more difficult.

The researchers also observed similarities between this campaign and the “Fake Font” variant of the long-running Contagious Interview operation, which has previously targeted software developers through fake recruitment schemes.

At the time of writing, developers are encouraged to remove affected packages immediately and investigate their development environments for signs of compromise.

Industry Context: Why Software Supply Chain Attacks Are Increasing

Software supply chain attacks continue to evolve because attackers understand that compromising one trusted package can affect thousands of downstream developers.

Modern development heavily depends on open-source ecosystems such as npm, Go modules, and PyPI, making dependency trust a critical security concern.

Readers interested in similar attacks can also explore CyberNexora’s Cyber Incidents section for the latest malware campaigns, software supply chain attacks, and global cybersecurity incidents.

Organizations looking to strengthen developer security can also review CyberNexora’s Learn & Protect resources for practical guidance on defending against emerging cyber threats.

Security teams can further explore CyberNexora’s Resources section to discover cybersecurity tools, reference materials, and security best practices.

How to Protect Yourself and Your Organization

1. Immediately uninstall the affected npm and Go packages.
2. Inspect all project directories for hidden:

.vscode/tasks.json

files.

3. Look specifically for tasks configured with:

runOn: "folderOpen"

4. Rotate:

• Git credentials
• API keys
• Cloud access tokens
• SSH keys
• Password manager credentials

5. Scan systems using updated endpoint detection and antivirus solutions.
6. Review developer workstations for unauthorized outbound connections.
7. Audit dependency sources before installation.
8. Enable software composition analysis (SCA) tools to identify compromised packages.

Indicators of Compromise (IoCs)

Possible indicators include:

• Hidden .vscode/tasks.json
• Task named eslint-check
• Fake .woff2 font files
• Unexpected Socket.IO connections
• Unknown Python processes
• Suspicious blockchain communication
• Unauthorized outbound traffic
• Newly downloaded Python payloads

Key Takeaways

• Two hijacked npm packages and sixteen compromised Go packages distributed malware.
• Attackers abused VS Code auto-run tasks instead of npm lifecycle scripts.
• Blockchain transactions were used as resilient dead-drop infrastructure.
• Malware deployed a Socket.IO backdoor followed by a Python infostealer.
• Developers should rotate credentials and inspect hidden VS Code task files immediately.

Conclusion: VS Code Infostealer Attack and What Happens Next

The VS Code Infostealer Attack demonstrates how software supply chain threats continue to evolve beyond conventional package installation techniques. By exploiting trusted developer workflows and Visual Studio Code automation features, attackers significantly reduced the chances of immediate detection.

Organizations should treat development environments as high-value targets, continuously monitor third-party dependencies, and adopt stronger software supply chain security practices. As attackers continue to innovate, proactive dependency auditing and credential hygiene remain essential defenses against similar campaigns.