Hijacked npm and Go packages exploit VS Code Tasks to deliver Python infostealer
Researchers at JFrog found two malicious npm packages and a suite of compromised Go modules that hide a VS Code task named eslint‑check. When a developer opens the project folder, the task runs automatically, pulling encrypted JavaScript and installing a Python‑based infostealer on Windows, Linux and macOS. This bypasses traditional npm lifecycle scripts, making detection harder.