# JadeSnow: Hijacked npm/Go Supply Chain Attack with VSCode Exploitation and Blockchain Dead Drops

> Sophisticated supply chain attack exploiting two hijacked npm packages (html-to-gutenberg v4.2.11, fetch-page-assets v1.2.9) and 16 compromised Go packages to deploy multi-stage credential and cryptocurrency stealing malware. Uses VSCode task auto-execution and blockchain infrastructure (Tron, Aptos, BSC) for resilient command & control, targeting browsers, wallets, password managers, and developer tools across Windows, macOS, and Linux.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-08-13T10:33:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0987
- **ID:** TL-2026-0987
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

JadeSnow represents a sophisticated multi-vector supply chain attack discovered June 2026 that compromised the npm and Go package ecosystems. The attack exploits VSCode folder-open tasks configured with runOn: 'folderOpen' to auto-execute hidden JavaScript payloads when developers open malicious projects, circumventing npm v12 lifecycle script security hardening.

The attack chain comprises five linked stages. Stage 1 (Fake Font Loader) executes JavaScript disguised as a WOFF2 font file and retrieves encrypted payloads from blockchain transaction dead drops (Tron, Aptos, BSC JSON-RPC). Stage 2 (Boot Payload) decodes XOR-encrypted payloads and connects to attacker C2 infrastructure (166.88.134.62, 198.105.127.210, 23.27.202.27) using victim-marker HTTP headers. Stage 3 (Socket.io Backdoor) establishes persistent interactive access via socket.io library with full command execution, clipboard access, and arbitrary code execution. Stage 4 (Runtime Bootstrapper) creates user-level npm dependency directories (~/.node_modules) and loads a Python interpreter, downloading python.zip/python.7z from attacker infrastructure if missing. Stage 5 (Python Infostealer) performs comprehensive credential harvesting across Chromium browsers (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Comet, Dia), Firefox, 30+ cryptocurrency wallets (MetaMask, Phantom, Trust Wallet, Binance, Coinbase, OKX, Ledger, Trezor, etc.), password managers (1Password, LastPass, Bitwarden, Keeper, RoboForm, Proton Pass, NordPass), and developer credentials (Git, GitHub, VS Code global storage, SSH keys, cloud provider tokens).

The npm packages were uploaded May 25, 2026; the discovery came June 24, 2026, by which time attacker infrastructure remained active. Sixteen additional Go packages were compromised using identical malicious payload structure, spanning legitimate projects with recent commits in 2023-2026. The attack avoids common detection by leveraging public blockchain APIs for payload exfiltration, creating a resilient command-and-control layer that persists as long as blockchain services remain accessible. Collected data is staged in %USERPROFILE%\.npm (Windows) or /tmp/.npm (Linux/macOS), encrypted, and uploaded via HTTP POST to C2 endpoints or Telegram bot APIs. The attacker utilizes dynamic Telegram bot tokens returned by C2 endpoints, creating an additional exfiltration channel that bypasses traditional email-based defenses.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1547 Boot or Logon Autostart Execution
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1176 Software Extensions
- T1071 Application Layer Protocol
- T1092 Communication Through Removable Media
- T1001 Data Obfuscation
- T1568 Dynamic Resolution
- T1048 Exfiltration Over Alternative Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1090 Proxy
- T1020 Automated Exfiltration
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account

## Sources

- [JFrog Security Research: Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops](https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/)
- [Nextron Research: 16 Go Packages Identified with Same Malicious Payload](https://x.com/nextronresearch/status/2069802303817679083)
- [Malpedia Library: js.jadesnow](https://malpedia.caad.fkie.fraunhofer.de/library/ed6f5835-ee27-43c2-a68a-59ca287736d3/)
- [npm v12 Security Hardenings](https://jfrog.com/blog/npm-v12-from-implicit-to-explicit-trust/)
- [BeaconBeagle C2 Infrastructure Intelligence](https://beaconbeagle.com/api/v1/beacons)
- [Tron Blockchain Analysis: TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Transaction History](https://tronscan.org/#/address/TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP)
- [Aptos Blockchain Explorer: Dead-Drop Transaction Analysis](https://explorer.aptoslabs.com/)
- [BSC (Binance Smart Chain) Transaction Analysis: eth_getTransactionByHash](https://bscscan.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0987