Embedded Malicious Code Affecting html-to-gutenberg package, versions =4.2.11
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-HTMLTOGUTENBERG-17434799
- published24 Jun 2026
- disclosed24 Jun 2026
- creditUnknown
Introduced: 24 Jun 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the html-to-gutenberg package.
Overview
html-to-gutenberg is a Transform any valid HTML string into fully editable WP Gutenberg blocks in seconds rather than hours.
Affected versions of this package are vulnerable to Embedded Malicious Code. This release contains a multi-stage, blockchain-C2 remote code execution loader in .vscode/tasks.json that runs when the package folder is opened in VS Code. The obfuscated payload is delivered in font files and attempts to steal cryptocurrency in an EtherHiding-style attack.