Hijacked npm and Go Packages Deploy Python Info Stealer via VS Code Tasks

Researchers at JFrog discovered two hijacked npm packages and a cluster of Go packages that install a Python-based information stealer on Windows, Linux, and macOS. The attack bypasses npm lifecycle scripts to evade detection and remains compatible with npm v12 security measures. The malware targets credentials and sensitive data from compromised systems.