Hijacked npm and Go packages deliver a multi-stage malware chain via a malicious VS Code task (eslint-check, runOn: folderOpen) that auto-executes on folder open. The payload is hidden in a fake font file (public/fonts/fa-solid-400.woff2) and fetches XOR-encrypted next stages from blockchain transaction data (Tron, Aptos, BSC RPC) used as dead-drops, leading to a Socket.io backdoor and a Python infostealer targeting browsers, password managers, and crypto wallets. Affected: npm html-to-gutenberg 4.2.11, fetch-page-assets 1.2.9, plus 16 Go modules carrying the same payload.