DPRK malware came back in the next release of fetch-page-assets after npm's June takedown

A .vscode/tasks.json entry runs when the folder opens in the editor. A file ending .woff2 looks like a font to anything that sorts by extension. Those are two of the places OpenSourceMalware says PolinRider keeps its obfuscated JavaScript, alongside build configs such as eslint.config.mjs, postcss.config.mjs and babel.config.cjs ^[1]. None of those is a dependency manifest. When npm pulled fetch-page-assets 1.2.9 and html-to-gutenberg 4.2.11 after JFrog's June research, the auto-execution trigger in the maintainer's repository stayed where it had been since March ^[9][11][12].

The maintainer, Diogo Angelim, is a working developer by OpenSourceMalware's account: GitHub handle digelo, npm handle digelim, account created February 2016, eight public repositories, a decade of sporadic contributions ^[7]. One of the packages, fetch-page-assets, pulls CSS, JavaScript, fonts and images out of a URL ^[8]. They noticed something was wrong and made two visible cleanup attempts over five months ^[14]. OpenSourceMalware wrote that, like many PolinRider victims, they "removed the visible symptom but missed mechanism" ^[10]. As of last Sunday, the post says, a fresh DPRK payload was live in the latest release on npm ^[13].

The July count was 4,367 repositories across 2,152 owners, which the company calls a 6.5x increase since March ^[2]. Working backwards from that multiple puts the March footprint near 672 repositories and the four-month growth near 3,700 ^[16][17]. The ratio is about two infected repositories per owner ^[18].

npm's and GitHub's answer to malicious code is an advisory against one package at one version, followed by a takedown of that exact tarball ^[5]. OpenSourceMalware wrote that the model "was designed for a world of one-off malicious packages" ^[6]. This maintainer produced one advisory in five months ^[14], and the company counts more than 2,100 identified victim maintainers in a position to repeat the same sequence ^[15].

Everything above 4,367 is estimate. OpenSourceMalware puts the real footprint in the tens of thousands and says other threat intelligence vendors have told it the figure is in the hundreds of thousands; the post does not name those vendors ^[3][21].

The editor's-config blind spot is inference. The post does not test how dependency scanners or human code review handle these file types. An experienced maintainer with a JFrog writeup and an npm advisory pointing at their own account went looking twice, cleaned what they could see, and shipped a working DPRK payload in the next release ^[10][11][13].