A threat actor inserted a heavily whitespace-padded JavaScript downloader into a Tailwind CSS configuration file in a private GitHub repository, causing it to execute inside developers' Node.js environments. The multistage JADESNOW chain retrieved encrypted payloads through TRON, Aptos, and Binance Smart Chain transactions before installing the InvisibleFerret.JavaScript backdoor in VS Code or Cursor AI. InvisibleFerret established persistence by modifying editor telemetry modules and supported system profiling, arbitrary JavaScript execution, and recursive theft of files and directories. The Cyber Centre published hashes, C2 infrastructure, ATT&CK mappings, and a YARA rule for detecting the obfuscated downloader.