MSC-2026-6197

Hijacked npm and Go packages deliver a multi-stage malware chain via a malicious VS Code task eslint-check, runOn: folderOpen that auto-executes on folder open. The payload is hidden in a fake font file public/fonts/fa-solid-400.woff2 and fetches XOR-encrypted next stages from blockchain...

Malware in html-to-gutenberg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-6359 Malicious code in html-to-gutenberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad55bd01687902eea54021b3d30ce0b10f795a1521b425b32e57ef46b7a4ae77 The published tarball contains api.js at the package root, a heavily obfuscated loader using an obfuscator.io-style XOR-decoded string table key 0x46...

Embedded Malicious Code

Overview html-to-gutenberg is a Transform any valid HTML string into fully editable WP Gutenberg blocks in seconds rather than hours. Affected versions of this package are vulnerable to Embedded Malicious Code. This release contains a multi-stage, blockchain-C2 remote code execution loader in...

Malicious code in html-to-gutenberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad55bd01687902eea54021b3d30ce0b10f795a1521b425b32e57ef46b7a4ae77 The published tarball contains api.js at the package root, a heavily obfuscated loader using an obfuscator.io-style XOR-decoded string table key 0x46...