Hijacked npm Packages Trigger VS Code Tasks for Blockchain-Resolved Python Stealer

The packages html-to-gutenberg and fetch-page-assets contained .vscode/tasks.json configured to run eslint-check on workspace open. Execution pulled encrypted JS from blockchain transactions, established a socket.io backdoor, and launched a Python loader harvesting Chromium, Firefox, wallet, and Git credentials across Windows, Linux, and macOS. JFrog's analysis confirms the chain avoided npm lifecycle scripts entirely. Evidence from OpenSourceMalware tracking shows identical font-file disguise and blockchain dead-drop patterns in prior Fake Font operations since 2023. No packet captures or binary hashes have been publicly released to confirm operator identity beyond tactic overlap. The Go cluster remains undetailed in available reports. This marks continued refinement of developer-targeted supply chain operations that bypass registry hardening and IDE trust prompts. Similar patterns appear in earlier Contagious Interview waves, indicating sustained investment in IDE and package ecosystem persistence rather than one-off campaigns. Next indicators include new packages reusing the same tasks.json structure or TronGrid resolver domains. Registry monitoring for folderOpen tasks will surface additional instances within weeks.