Malware Hidden in Dev Repos Executes Automatically When VS Code Opens Folder

A newly documented malware dropper is being committed directly into developer repositories and requires no npm install to execute — it runs automatically when a developer starts a dev server or opens the project folder in VS Code. The malware disguises its payload as a font file and buries malicious code thousands of spaces deep in a config file, making it nearly invisible during code review. To evade IP-based blocking, it uses a technique called EtherHiding, retrieving its command-and-control server address by decoding an Ethereum wallet transaction, allowing operators to shift infrastructure with a single blockchain transaction. The decoded payload runs entirely in memory and detaches from the editor process, meaning it persists even after VS Code is closed; one observed sample operated as a clipboard stealer, capturing passwords and access tokens every 200 milliseconds. One instance of the malware went undetected in a repository for five months, and developers can check for infection using a short set of terminal commands targeting suspicious node processes, wallet address references, and folderOpen task configurations.