Backdoored Open VSX Extension Used GitHub Downloader to Deploy RAT and Stealer
An extension available on the Open VSX registry has been found to contain malware that installs a remote access trojan (RAT) and an infostealer on developer machines without notification.
An extension available on the Open VSX registry has been found to contain malware that installs a remote access trojan (RAT) and an infostealer on developer machines without notification.
The extension, named fast-draft under the KhangNghiem publisher account, was downloaded over 26,000 times before its malicious components were identified. The compromised versions include 0.10.89, 0.10.105, 0.10.106, and 0.10.112.
These versions connected to a GitHub repository managed by the threat actor BlokTrooper, downloading shell scripts that executed a second-stage malware payload. Other versions, such as 0.10.88, 0.10.111, and 0.10.135, did not exhibit this behavior, suggesting a compromised publisher account or stolen release token.
Security analysts discovered the issue during a manual review of the fast-draft release line. The issue was reported to the extension maintainer on March 12, 2026, but no response has been received.
The extension, named fast-draft under the KhangNghiem publisher account, was downloaded over 26,000 times before its malicious components were identified.
The malware grants attackers full control over infected machines, with capabilities to steal browser credentials, cryptocurrency wallet data, and other sensitive information. Over 26,594 downloads indicate significant potential exposure among developers and software teams.
Developers should remove any affected versions of fast-draft and rotate stored credentials, cryptocurrency wallet seed phrases, and API keys. Network administrators should block and monitor traffic to 195.201.104.53 on ports 6931, 6936, and 6939, and flag requests to raw.githubusercontent.com/BlokTrooper .
The attack framework involves a shell downloader that retrieves a ZIP archive, launching four Node.js processes. The modules facilitate remote control over the infected system, steal browser data and cryptocurrency wallet information, and scan for sensitive local files. It also targets high-value AI-assisted developer environments.
Immediate action is required to mitigate risks and protect sensitive information.
Based on reporting by Cyber Security News.