Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer

Author(s): Guy Korolevski, Yair Benamou
Organization: JFrog Security

Open article directly Open article on Archive.org

2026-06-30 ⋅ JFrog Security ⋅ Yair Benamou
Lazarus-Linked npm Malware Masquerades as Rollup Polyfills
OtterCookie

2026-06-22 ⋅ JFrog Security ⋅ Yair Benamou
From PostCSS Masquerading to Windows RAT
PylangGhost

Propose Change Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer