---
id: 2448
title: "fast-draft Open VSX Extension Compromised by BlokTrooper"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper"
published_at: "2026-03-18 00:00"
tags: ["supply-chain", "malware", "infostealer", "supply-chain-security", "vscode-extensions", "open-vsx", "rat"]
phying_url: "https://phying.com/item/2448"
lang: en
---

# fast-draft Open VSX Extension Compromised by BlokTrooper

## Summary

Multiple fast-draft releases on Open VSX fetched a GitHub-hosted downloader that delivered a RAT and infostealer. The alternating clean and malicious versions suggest a stolen publisher token.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-03-18 00:00
- **Original:** https://www.aikido.dev/blog/fast-draft-open-vsx-bloktrooper
- **Phying News:** https://phying.com/item/2448