Cybersecurity researchers have uncovered a supply chain attack involving two hijacked npm packages and a cluster of Go packages. The malicious packages are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts.
According to JFrog, the attack avoids the most common npm execution paths through lifecycle scripts. This technique may be an attempt to remain compatible with npm version 12's security hardening measures, making detection more difficult for developers and security tools.
The attack vector leverages VS Code tasks to execute the payload, a method that sidesteps typical hooks used to monitor package installations. The cross-platform nature of the infostealer enables it to target a wide range of developer environments, capturing sensitive data such as credentials and tokens.
No specific indicators of compromise or patch status for affected packages have been released yet by JFrog or package registries. Developers are advised to audit their dependencies for the identified malicious packages and ensure they are using the latest versions of npm and Go modules to reduce exposure.
The attack highlights an evolving trend where adversaries adapt to package manager security updates by shifting to alternative execution methods. Attribution for the campaign remains unclear at this time, but the sophistication suggests a well-resourced threat actor.