Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle scripts, perhaps in

Related Stories

📰

Clean GitHub repo tricks AI coding agents into running malware

Windows Containers to Supersede Docker, courtesy of WSL

OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards

IBM, Red Hat and Deloitte Unite to Secure Open-Source Codebases