Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Researchers found hijacked npm packages and 16 Go packages using fake font files and VS Code tasks to deploy a Python infostealer.
More info