MEDIUMSupply Chain
Global

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps in an attempt to remain 'compatible' with npm v12's security hardenings," JFrog said in a

Analysis

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps in an attempt to remain 'compatible' with npm v12's security hardenings," JFrog said in a
Source Attribution

Originally published by The Hacker News on Jun 29, 2026.

Related Threats

LOWSupply Chain

Inside the Advisory Database and what happens when vulnerability volume breaks records

The GitHub Advisory Database is processing more vulnerability reports than ever before. Here's what's driving the surge, how we're responding, and how the community can help. The post Inside the Advisory Database and what happens when vulnerability volume breaks records appeared first on The GitHub Blog .

GitHub Security Blog
CRITICALSupply Chain

Post-Quantum Security Spurs National Sovereignty Thinking

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/post-quantum-security-spurs-national-sovereignty-thinking-image_small-10-a-32095.jpg" align=right hspace=4><b>AI Export Controls Expose Hidden Risks to Post-Quantum Cryptography Migrations</b><br>Security leaders warn that post-quantum cryptography migration is creating new dependencies on foreign vendors, hyperscalers and supply

Bank Info Security
LOWSupply Chain

Polymarket customers lose $3 million in supply-chain attack

Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platform's frontend following a breach at a third-party vendor. [...]

BleepingComputer