Affected Systems
Compromised npm and Go packages targeting developers using Microsoft Visual Studio Code on Windows, Linux, and macOS. Attack bypasses npm v12 lifecycle script protections by abusing VS Code task execution.
Exploitation Status
Active exploitation confirmed. Malicious packages deployed in the wild targeting developer environments across multiple platforms.
Business Impact
Developer workstations are at risk of information theft including credentials, source code, and environment variables. The technique evades npm v12 security hardening, making detection difficult. Organizations using npm or Go package managers face supply chain compromise risk. No CVE assigned yet, limiting automated vulnerability scanning coverage.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit npm and Go package dependencies immediately using tools like npm audit, Snyk, or Socket Security to identify suspicious packages
- Review VS Code workspace settings and .vscode/tasks.json files for unauthorized task definitions that execute on project open
- Implement package integrity verification using lock files (package-lock.json, go.sum) and verify checksums before installation
- Restrict VS Code task auto-execution by setting 'task.allowAutomaticTasks' to false in user or workspace settings
- Monitor developer endpoints for unexpected Python process execution and outbound connections to unknown domains