Hackers Infiltrate VS Code Marketplace with 19 Malicious Extensions Posing as PNG File
Security researchers have identified a significant security threat targeting developers through the VS Code Marketplace. A coordinated campaign involving 19 malicious extensions has infiltrated the platform, remaining undetected since February 2025.
Security researchers have identified a significant security threat targeting developers through the VS Code Marketplace. A coordinated campaign involving 19 malicious extensions has infiltrated the platform, remaining undetected since February 2025.
These extensions contain hidden malware within their dependency folders, designed to evade security detection and compromise developer machines.
The campaign illustrates a shift in attacker strategies towards targeting the software supply chain. Attackers create extensions that either impersonate legitimate packages or claim to offer genuine features.
Upon installation, these extensions execute malicious code in the background. The sophisticated method of concealment involves embedding executable files within seemingly harmless image files, specifically PNG files.
This approach adds a layer of deception, as developers typically do not suspect graphic files of containing executable code.
In the first ten months of 2025, malware detections on VS Code nearly quadrupled compared to 2024, increasing from 27 to 105 instances. This rise indicates that the VS Code Marketplace is becoming a more attractive target for malicious actors.
Security researchers have identified a significant security threat targeting developers through the VS Code Marketplace.
ReversingLabs security analysts determined that the malware exploits the structure of VS Code extensions. These extensions come pre-packaged with dependencies in a node_modules folder, allowing them to run without downloading additional components.
Researchers discovered that attackers weaponized the popular "path-is-absolute" npm package, which has over 9 billion downloads since 2021. By adding malicious code to this dependency, they transformed a trusted component into a delivery mechanism for the trojan.
The infection process starts when VS Code launches. The modified package's index.js file includes a new class that activates automatically upon startup.
This class decodes a JavaScript dropper concealed in the malicious banner.png file. The dropper is hidden through base64 encoding and string reversal, complicating manual analysis.
When executed, the dropper deploys two malicious binaries using cmstp.exe, a legitimate Windows tool that attackers exploit.
One binary manages the attack process, while the other is a more sophisticated Rust-based trojan, which was still under investigation at the time of discovery. Four extensions in the campaign used different methods, splitting the binaries into separate .ts and .map files instead of concealing them in PNG archives.
Development teams should audit their installed extensions, verify sources, and use security scanning tools before installation to prevent compromise.
Based on reporting by Cyber Security News.