OpenSource Malware: Active Malware Campaigns in January-May 2026

What it is

OpenSourceMalware's campaign-level analysis of 2026 open-source supply-chain malware, going beyond the summary with mechanism detail and defender-relevant specifics on Lazarus Group's TasksJacker/PolinRider operation and TeamPCP's Trivy attack.

How it works

The critical detail the summary omits: .vscode/tasks.json executes automatically the moment a cloned repo is opened in VS Code — no social engineering, no user action. This is why TasksJacker dropped the recruiter-outreach step that Contagious Interview relied on.

Payload delivery uses two redundant vectors:

• Fake Font — the task runs node public/fonts/fa-brands-regular.woff2, a file containing hex-encoded JavaScript (not font data) that decodes and runs BeaverTail. Chosen because a .woff2 asset is never inspected in review.
• Malicious Dictionary — a spellright.dict file holding ~6KB of obfuscated JavaScript, mimicking the SpellRight extension's format. It's a deliberate fallback: if a defender spots and deletes tasks.json, this payload survives. Removing the obvious file is not sufficient remediation.

C2 uses a multi-blockchain architecture across TRON, Aptos, and Binance Smart Chain, so traditional domain-seizure takedowns do not work.

BeaverTail loads InvisibleFerret, a Python backdoor stealing crypto wallets, browser credentials, and SSH keys — those stolen credentials then feed Phase 2 (PolinRider) and cross-registry spread.

The two phases are linked by shared artifacts: the same temp_auto_push.bat script and TRON C2 addresses appear in both, confirming one operation.

Preconditions / Affected

• Developers who clone and open a compromised repo in VS Code (TasksJacker: 400+ repos across dozens of orgs including DataStax; peak 39 repos on Jan 29, 2026).
• Maintainers merging config-file changes in PRs — PolinRider hit projects with 1M+ combined stars (VS Code, Apache Superset, Rails, LangFlow, Expo); three PRs reached production before detection.
• TeamPCP's Trivy attack turned on a single unrevoked aqua-bot PAT from an incomplete rotation at Aqua Security, used to force-push malicious commits to 76 version tags, hitting every CI runner pulling those Trivy GitHub Actions.

What to do

The page states no mitigation commands, but the detection surface it names is concrete:

• Treat presence of .vscode/tasks.json, .woff2 files invoked via node, and spellright.dict in cloned repos as suspect; check for both payloads, not just tasks.json.
• Hunt for the temp_auto_push.bat script and TRON/Aptos/BSC C2 references.
• Audit for unrevoked service-account PATs after any incomplete credential rotation (the Trivy root cause).

Caveats

Tracking is OpenSourceMalware's own: "at least 11 distinct variants across 17+ repositories," with infrastructure rotating continuously in response to takedowns — figures are floors, not totals. The fetched text is truncated mid-sentence in the TeamPCP section.