Le mélange des deux va être rigolo. Il me semble que SO a déjà constaté des baisses d'activité.
https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace
A month after Shai Hulud became the first self-propagating worm in the npm ecosystem, we just discovered the world's first worm targeting VS Code extensions on OpenVSX marketplace.
But GlassWorm isn't just another supply chain attack. It's using stealth techniques we've never seen before in the wild - invisible Unicode characters that make malicious code literally disappear from code editors. Combine that with blockchain-based C2 infrastructure that can't be taken down, Google Calendar as a backup command server, and a full remote access trojan that turns every infected developer into a criminal proxy node.
Security experts have helped remove malicious NuGet packages planted in 2023 that were designed to destroy systems years in advance, with some payloads not due to hit until the latter part of this decade.
Socket's researchers identified nine malicious packages on the .NET package manager containing destructive code due to trigger between 2027 and 2028, with one affecting "safety-critical systems in manufacturing environments."
Of the 12 packages published by the NuGet user shanhai666 between 2023 and 2024, nine contained malicious code and have been downloaded nearly 10,000 times.
Notably, the packages are comprised of genuinely useful code serving legitimate purposes. Kush Pandya, security engineer at Socket, said 99 percent of the code among these packages was benign, which serves as a trust-builder.
On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
This vulnerability was disclosed as CVE-2025-55182 and is rated CVSS 10.0.
(...)
The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:
react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack
(...)
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.