JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode Exploitation and Blockchain Dead Drops

JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode (TL-2026-0987), also tracked as Hijacked npm vscode-blockchain-npm, is a critical-severity malware campaign, first published 2026-06-28 and last reviewed 2026-08-13. It has no confirmed attribution, affects npm (JavaScript Package Registry) html-to-gutenberg, maps to 32 MITRE ATT&CK techniques (T1001, T1003, T1005), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-0987

Threat ID
TL-2026-0987
Also known as
Hijacked npm vscode-blockchain-npm, JadeSnow supply chain
Severity
CRITICAL
Status
ACTIVE
Category
MALWARE
First published
2026-06-28
Last reviewed
2026-08-13
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
software-development, financial-services, cryptocurrency-exchanges, cryptocurrency-wallets, password-management, saas, infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
25
Updates
2026-08-13 · 2 updates

Sophisticated supply chain attack exploiting two hijacked npm packages (html-to-gutenberg v4.2.11, fetch-page-assets v1.2.9) and 16 compromised Go packages to deploy multi-stage credential and cryptocurrency stealing malware. Uses VSCode task auto-execution and blockchain infrastructure (Tron, Aptos, BSC) for resilient command & control, targeting browsers, wallets, password managers, and developer tools across Windows, macOS, and Linux.

How JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode works

JadeSnow represents a sophisticated multi-vector supply chain attack discovered June 2026 that compromised the npm and Go package ecosystems. The attack exploits VSCode folder-open tasks configured with runOn: 'folderOpen' to auto-execute hidden JavaScript payloads when developers open malicious projects, circumventing npm v12 lifecycle script security hardening.

The attack chain comprises five linked stages. Stage 1 (Fake Font Loader) executes JavaScript disguised as a WOFF2 font file and retrieves encrypted payloads from blockchain transaction dead drops (Tron, Aptos, BSC JSON-RPC). Stage 2 (Boot Payload) decodes XOR-encrypted payloads and connects to attacker C2 infrastructure (166.88.134.62, 198.105.127.210, 23.27.202.27) using victim-marker HTTP headers. Stage 3 (Socket.io Backdoor) establishes persistent interactive access via socket.io library with full command execution, clipboard access, and arbitrary code execution. Stage 4 (Runtime Bootstrapper) creates user-level npm dependency directories (~/.node_modules) and loads a Python interpreter, downloading python.zip/python.7z from attacker infrastructure if missing. Stage 5 (Python Infostealer) performs comprehensive credential harvesting across Chromium browsers (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Comet, Dia), Firefox, 30+ cryptocurrency wallets (MetaMask, Phantom, Trust Wallet, Binance, Coinbase, OKX, Ledger, Trezor, etc.), password managers (1Password, LastPass, Bitwarden, Keeper, RoboForm, Proton Pass, NordPass), and developer credentials (Git, GitHub, VS Code global storage, SSH keys, cloud provider tokens).

The npm packages were uploaded May 25, 2026; the discovery came June 24, 2026, by which time attacker infrastructure remained active. Sixteen additional Go packages were compromised using identical malicious payload structure, spanning legitimate projects with recent commits in 2023-2026. The attack avoids common detection by leveraging public blockchain APIs for payload exfiltration, creating a resilient command-and-control layer that persists as long as blockchain services remain accessible. Collected data is staged in %USERPROFILE%\.npm (Windows) or /tmp/.npm (Linux/macOS), encrypted, and uploaded via HTTP POST to C2 endpoints or Telegram bot APIs. The attacker utilizes dynamic Telegram bot tokens returned by C2 endpoints, creating an additional exfiltration channel that bypasses traditional email-based defenses.

MITRE ATT&CK techniques used in TL-2026-0987

Command and Control

T1001 Data Obfuscation; T1071 Application Layer Protocol; T1090 Proxy; T1092 Communication Through Removable Media; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port

Credential Access

T1003 OS Credential Dumping; T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Collection

T1005 Data from Local System; T1115 Clipboard Data

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts

exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

persistence

T1176 Software Extensions

Initial Access

T1195 Supply Chain Compromise

Persistence

T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1547 Boot or Logon Autostart Execution

Affected products and versions in JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode

  • npm (JavaScript Package Registry) — html-to-gutenberg
    Vulnerable versions: 4.2.11
  • npm (JavaScript Package Registry) — fetch-page-assets
    Vulnerable versions: 1.2.9
  • GitHub (Go Package Registry) — github.com/Barsu5489/commerce
    Vulnerable versions: v0.0.0-20231123164829-2eb351369e57
  • GitHub (Go Package Registry) — github.com/Setsu548/Logistic
    Vulnerable versions: v0.0.0-20240410002038-5b40bed74f90
  • GitHub (Go Package Registry) — github.com/amantsehay/a2sv-go-course
    Vulnerable versions: v0.0.0-20240816090215-c51e2d9214d5
  • GitHub (Go Package Registry) — github.com/anatoli-derese/a2sv-excercise
    Vulnerable versions: v0.0.0-20240805074755-5adbbc600635
  • GitHub (Go Package Registry) — github.com/bm-197/chill
    Vulnerable versions: v0.0.0-20241216030053-8573b6044fba
  • GitHub (Go Package Registry) — github.com/dexbotsdev/uniswap-v2-v3-arbitrage
    Vulnerable versions: v0.0.0-20231007040503-7b0a4d1c503d
  • GitHub (Go Package Registry) — github.com/glacialspring/go-winsparkle
    Vulnerable versions: v0.0.0-20250402002608-ba5501b8ba90
  • GitHub (Go Package Registry) — github.com/glacialspring/static
    Vulnerable versions: v0.0.0-20181015024211-023dc73bc332

Weaknesses (CWE) in JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode

CWE-95, CWE-94, CWE-426, CWE-427, CWE-829, CWE-200, CWE-502, CWE-347

Timeline of JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode

  • Hijacked npm packages html-to-gutenberg v4.2.11 and fetch-page-assets v1.2.9 uploaded to npm registry by attacker. Malicious versions introduced VSCode task execution vector alongside legitimate package metadata.
  • npm registry removes malicious package versions html-to-gutenberg v4.2.11 and fetch-page-assets v1.2.9 from public availability. Attacker infrastructure remains active.
  • JFrog Security Research team discovers and analyzes malicious npm packages, reverse-engineers full 5-stage payload chain, publishes comprehensive technical analysis. Detects C2 infrastructure, blockchain dead-drop mechanism, wallet and credential targeting.
  • Nextron Research identifies 16 additional compromised Go packages on GitHub containing identical malicious payload structure. Packages span legitimate projects with commit timestamps from 2018-2026; some remain live for download.
  • Attack assessed as ongoing global supply chain threat with active exploitation capability. Developers may continue to pull malicious Go packages from GitHub if not actively monitoring or implementing supply-chain security controls.
  • C2 infrastructure (166.88.134.62, 198.105.127.210, 23.27.202.27) confirmed active and capable of serving Python payloads and receiving exfiltrated credentials. Blockchain accounts (Tron, Aptos) continue to function as dead-drop infrastructure.
  • Comprehensive threat intelligence package published documenting full attack chain, IOC lists, MITRE ATT&CK mappings, and remediation guidance for defenders and security teams.
  • JFrog Xray detection rules deployed and made available to customers to identify and block malicious packages (XRAY-1008590, XRAY-1008535, XRAY-1009779 through XRAY-1009796).

Update history for TL-2026-0987

  • 2026-08-13 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 6 community-related indicator(s).
  • 2026-08-04 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 5 community-related indicator(s).

Sources cited for JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode

Threats related to JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode

Detection coverage for TL-2026-0987

As of 2026-08-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0987 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0987

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats