PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

fast-draft Open VSX Extension Compromised by BlokTrooper

aikido.dev | blog | #supply-chain | #malware | #infostealer | #supply-chain-security | #vscode-extensions | #open-vsx | #rat
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Multiple fast-draft releases on Open VSX fetched a GitHub-hosted downloader that delivered a RAT and infostealer. The alternating clean and malicious versions suggest a stolen publisher token.
Published
Collected

Related coverage

blog · aikido.dev
LiteLLM compromised again: infostealer and RAT found in version 1.107.0
# LiteLLM compromised again: infostealer and RAT found in version 1.107.0 Written by Ilyas Makari Published on: Oct 21, 2026 On October 21, 2026, version 1.107.0 of LiteLLM (a popular open source...
blog · aikido.dev
What is Slopsquatting? The AI Package Hallucination Attack Already Happening
Slopsquatting is typosquatting's AI successor: attackers register package names LLMs hallucinate, waiting for developers to install them on the model's recommendation. It's already happening.
blog · aikido.dev
Introducing Aikido Expansion Packs: Safer defaults inside the IDE
Aikido Expansion Packs add opt-in security inside the IDE: a pre-commit secrets hook plus Safe Chain, which screens npm and pnpm installs for malware and holds brand-new releases for 24 hours.
blog · aikido.dev
Introducing Aikido Package Health: a Better Way to Trust Your Dependencies
Aikido Package Health surfaces the true health of an open source package with a single score. It helps devs understand stability, maintenance quality, and supply-chain risk before installing a dependency.
blog · aikido.dev
The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties
Aikido tracked one threat actor from npm and Open VSX to GitHub: commits with null emails hide payloads in invisible PUA Unicode, executed via eval within seemingly legitimate feature updates.
blog · aikido.dev
RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)
A supply chain attack hit the rand-user-agent npm package: hidden code deployed a RAT with socket.io C2 channels, file exfiltration, and a Python PATH hijack across versions released after 2.0.82.
Back