Threat Actors Weaponized Open VSX Extension To Drop RAT and Stealer via GitHub

The Open VSX extension “fast-draft” by KhangNghiem has been weaponized to distribute malware, joining a growing trend of supply chain attacks targeting developer environments.

With over 26,000 downloads, the extension executed a GitHub-hosted downloader to drop a remote access trojan and information stealer.

The malicious releases include versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112. Interestingly, these malicious builds are sandwiched directly between clean versions, such as 0.10.88, 0.10.111, and the most recent 0.10.135.

This alternating release pattern strongly suggests that the publisher account was compromised or that a publishing token was stolen, rather than the original maintainer intentionally turning rogue.

If the maintainer were knowingly shipping malware, the version history would likely remain malicious rather than reverting to clean logic.

Attack Execution and Payload Modules

The attack initiates when a compromised version of the extension executes a platform-specific shell script during editor startup. The extension reaches out to a raw GitHub repository hosted by the user BlokTrooper. It directly pipes the script into the system shell.

These scripts download a compressed archive, extract it into a temporary directory, and execute a bundled Node.js binary. The downloaded payload acts as a stage-two attack framework that operates completely in the background. It uses a temporary wrapper to hide runtime errors.

It dynamically rebuilds command-and-control IP addresses from configuration fields to evade static analysis. This framework then spawns four distinct, detached background processes to maximize the system’s compromise.

The first process establishes a remote desktop connection. It connects back to the attacker’s infrastructure over Socket.IO, granting the threat actor complete control over the victim system.

This module utilizes bundled dependencies to move the mouse, capture keystrokes, take screenshots, and read clipboard data. It actively checks for virtual machine environments but continues operating regardless of the sandbox, maintaining a process lock to prevent duplication.

The third process acts as a targeted file stealer. It recursively searches local drives for sensitive documents, configuration files, and secret keys.

The attackers specifically designed this module to ignore bulky application folders, such as build directories.

Instead, it prioritizes developer tools, source code repositories, and modern artificial intelligence coding environments, explicitly scanning for files related to tools like Cursor, Claude, and Windsurf.

Indicators Of Compromise

Security researchers notified the maintainer of the malicious activity in early March 2026. However, the issue remained unaddressed at the time of discovery.

The aikido presence of clean builds that bundle normal process execution means that simplistic static rules might miss malicious behavior.

To assist threat hunters and network defenders, the following table details the technical indicators associated with this attack infrastructure.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.