Security Risks in VS Code Extensions: Ransomware, Cryptomining, and Supply Chain Threats
TL;DR
Cybersecurity researchers discovered a vibe-coded malicious VS Code extension with built-in ransomware capabilities, which exfiltrates and encrypts files, and uses GitHub as a command-and-control server. Additionally, 17 npm packages disguised as SDKs were found to stealthily deploy Vidar Stealer, highlighting ongoing supply chain threats in open-source ecosystems. Microsoft has removed the malicious extension from the marketplace, emphasizing the importance of vigilance in software development.
Topics:technologycybersecurity#ai-generated-malware#cybersecurity#malicious-vs-code-extension#npm-packages#ransomware#supply-chain-attack
- Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities The Hacker News
- AI-Slop ransomware test sneaks on to VS Code marketplace BleepingComputer
- VSCode Extension Secrets, RediShell, & Living-off-the-LLM wiz.io
- Cryptomining targeted by fake VSCode extensions SC Media
- AI-Created Malicious VS Code Extension and Trojanized npm Packages Raise New Supply Chain Security Concerns CXO Digitalpulse
Want the full story? Read the original reporting
Read on The Hacker News