"A dropper family committed straight into developer repos. It executes on next dev or when VS Code opens the folder — no npm install needed. How it hides, why IP blocklists fail, and how to check your machine in a minute.
Source: [Dev.to](https://dev.to/avioflagos/malware-that-runs-the-moment-you-open-the-project-1j5e)