A supply-chain attack hiding inside everyday developer tools — triggered the moment a project folder is opened
Executive Summary
Security researchers uncovered a software supply chain attack in which attackers hijacked legitimate npm packages and a cluster of Go packages to quietly install a wide-reaching, Python-based information stealer on developer machines running Windows, Linux, or macOS. The infection is triggered automatically — not through a suspicious install script, but through a hidden task in a developer’s code editor that runs the moment a project folder is opened.
The stealer’s scope is unusually broad, targeting browser credentials, password managers, cryptocurrency wallets, and developer-specific secrets like Git and cloud tokens. For any organization that builds or maintains software, this is a reminder that trusted, everyday tools are now a primary attack surface.
Quick Facts
| Threat | Hijacked npm and Go packages deploying a Python-based infostealer |
| Disclosed | Late June 2026 (JFrog Security Research) |
| Trigger Mechanism | Automatic task execution when a project folder is opened in a code editor |
| Affected Systems | Developer workstations running Windows, Linux, or macOS with the affected packages installed |
| Highest Risk To | Software development teams, DevOps environments, and any business managing crypto assets or cloud credentials |
What It Is
Attackers compromised legitimate, previously-trusted open-source packages, quietly inserting malicious code into new versions. Rather than using the more easily-flagged installation scripts, the attackers hid their trigger inside an editor task configured to run automatically the moment a developer opens the affected project folder — no click, approval, or command required.
From there, the infection chain is deliberately staged to avoid detection: it retrieves encrypted instructions hidden inside unrelated-looking data, connects to attacker-controlled infrastructure, and ultimately installs a Python-based information stealer capable of harvesting an unusually broad set of sensitive data.
What the Stealer Targets
• Saved credentials and autofill data from Chromium-based browsers and Firefox
• Password manager and authenticator app data
• Cryptocurrency wallets and related application data
• Developer credentials: Git, code-hosting CLI and desktop tool data, editor global storage
• OS-level credential stores across Windows, Linux, and macOS
• Cloud storage metadata for major providers including Dropbox, Google Drive, OneDrive, and iCloud
Collected data is compressed and exfiltrated to attacker-controlled servers — and in some cases to a messaging-app bot — giving attackers rapid, low-friction access to whatever was stolen.
How the Infection Chain Works
• A developer installs (or already has installed) a compromised package version from an open-source registry.
• Opening the project folder in a code editor automatically triggers a hidden task — bypassing the install-time scripts most security tools watch for.
• The task retrieves further malicious code disguised inside unrelated-looking data, making the campaign resistant to takedown efforts.
• A backdoor connection is established, followed by delivery of the Python-based infostealer.
• The stealer harvests credentials, wallets, and developer secrets, then exfiltrates the data off the machine.
MITRE ATT&CK Mapping
| Tactic | Technique | ID |
| Initial Access | Supply Chain Compromise | T1195 |
| Execution | Trusted Developer Utilities / IDE Automation | T1127 / T1204 |
| Command and Control | Dead Drop Resolver (data hidden in legitimate-looking content) | T1102 |
| Credential Access | Credentials from Password Stores / Browsers | T1555 |
| Collection | Data from Local System / Archive Collected Data | T1005 / T1560 |
| Exfiltration | Exfiltration Over C2 Channel | T1041 |
Remediation Steps
• Audit every project’s editor task configuration files for tasks set to run automatically on folder open — treat any you don’t recognize as a potential incident.
• Review dependency trees for recently-updated packages, especially ones with unexplained file size increases or unfamiliar assets bundled inside.
• If any affected environment ran an install after mid-May 2026, rotate all credentials: source-control tokens, cloud provider tokens, and SSH keys.
• Use install options that skip automatic lifecycle scripts where practical, paired with dependency-scanning tools that can catch anomalies scripts alone would miss.
• Treat developer workstations as high-value targets in your security monitoring — not just production servers.
Why This Matters for Your Business
This campaign is a reminder that attackers are increasingly targeting the tools businesses trust implicitly, rather than trying to break through the front door. If your team doesn’t have visibility into what’s quietly executing inside your developers’ editors, now is the time to find out — before an attacker does.
