A maliciously modified version of a coding assistant extension was distributed through a code editor extension marketplace for Windows and macOS. The affected package was not created by the original developer, and the incident was limited to the identified versions. Other extensions and related products were not indicated as affected. The initial access vector was installation or update of the tampered package from the marketplace. In plain terms, the risk is that a user who installed or updated the package during the exposure window could run malicious code on a workstation, allowing an attacker to collect host information and attempt to create a persistent remote access channel.
The modified extension executes embedded malicious code after installation. It gathers host and user details, including the hostname, username, operating system, architecture, home directory location, environment variable names, working directories, configured version-control email, and public address. It then tries to place an attacker-controlled public key into the host's SSH authorized keys, enable the local SSH service, and create a reverse SSH tunnel to an external endpoint. To keep the tunnel running, it installs persistence using a macOS launch item or a Windows scheduled task that attempts to run with elevated privileges, with a startup fallback. Background scripts retry the tunnel about every minute. The external endpoint was later taken offline, so the reverse shell and host-detail reporting were no longer functional.[/subscribe_to_unlock_form]
A maliciously modified version of a coding assistant extension was distributed through a code editor extension marketplace for Windows and macOS. The affected package was not created by the original developer, and the incident was limited to the identified versions. Other extensions and related products were not indicated as affected. The initial access vector was installation or update of the tampered package from the marketplace. In plain terms, the risk is that a user who installed or updated the package during the exposure window could run malicious code on a workstation, allowing an attacker to collect host information and attempt to create a persistent remote access channel.
The modified extension executes embedded malicious code after installation. It gathers host and user details, including the hostname, username, operating system, architecture, home directory location, environment variable names, working directories, configured version-control email, and public address. It then tries to place an attacker-controlled public key into the host's SSH authorized keys, enable the local SSH service, and create a reverse SSH tunnel to an external endpoint. To keep the tunnel running, it installs persistence using a macOS launch item or a Windows scheduled task that attempts to run with elevated privileges, with a startup fallback. Background scripts retry the tunnel about every minute. The external endpoint was later taken offline, so the reverse shell and host-detail reporting were no longer functional.[emaillocker id="1283"]
No actor motivation, victim count, regional scope, or broader campaign scale is stated. The available findings indicate a limited supply-chain compromise of specific extension versions rather than a confirmed multi-target campaign. The external endpoint was disabled, and the marketplace was rebuilt after the malicious package was removed, reducing the chance of further distribution. Defensively, organizations should treat any installation of the affected versions as potentially compromised, verify extension provenance, review endpoints for unauthorized remote-access artifacts, and rotate credentials from trusted systems. It also underscores the need to monitor extension marketplaces for tampered packages and to restrict extension installation to trusted sources.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Execution | T1059.004 | Command and Scripting Interpreter | Unix Shell |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Persistence | T1543.001 | Create or Modify System Process | Launch Agent |
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Persistence | T1053.003 | Scheduled Task/Job | Cron |
| Persistence | T1078.004 | Valid Accounts | Cloud Accounts |
| Discovery | T1082 | System Information Discovery | - |
| Discovery | T1033 | System Owner/User Discovery | - |
| Discovery | T1016 | System Network Configuration Discovery | - |
| Command and Control | T1090.002 | Proxy | Communication through Web Service |
The following reports contain further technical details:
[/emaillocker]