Hackers Weaponized Open VSX Extension with Sophisticated Malware After Reaching 5060+ Downloads
A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations via a counterfeit Angular Language Service extension.
A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations via a counterfeit Angular Language Service extension.
The malicious package masqueraded as legitimate development tools, incorporating genuine Angular and TypeScript components alongside encrypted malware that activates upon opening HTML or TypeScript files.
The extension remained undetected for two weeks within the Open VSX marketplace, presenting itself as a trusted productivity tool for Angular developers.
Upon installation, it decrypted concealed payloads using AES-256-CBC encryption and established connections to command-and-control infrastructure situated on the Solana blockchain.
This technique provides attackers with persistent, censorship-resistant communication channels that are challenging for security teams to dismantle.
Annex analysts identified the malware after analyzing suspicious extension behavior in the Open VSX ecosystem.
The threat specifically targets developer credentials for NPM and GitHub, cryptocurrency wallets across 60 platforms, and browser-stored authentication tokens.
The extension remained undetected for two weeks within the Open VSX marketplace, presenting itself as a trusted productivity tool for Angular developers.
Geographic filtering mechanisms prevent execution on Russian systems, indicating the campaign originates from Russian-speaking threat groups aiming to avoid domestic prosecution.
The malware extends beyond simple data theft. It terminates browser processes to unlock database files, extracts OAuth tokens from VS Code configurations, and validates stolen credentials in real-time.
Exfiltrated data packages are compressed and transmitted to command servers, with backup infrastructure addresses retrieved through compromised Google Calendar links when primary channels become unavailable.
Blockchain-Based Command Infrastructure
The malware employs a technique known as "Etherhiding" to maintain resilient command-and-control operations through Solana blockchain transactions.
Following initial activation, the extension queries a specific Solana wallet address containing Base64-encoded instructions within transaction memo fields.
This architecture offers several advantages: blockchain immutability ensures configuration data persists indefinitely, public RPC endpoints remain highly available, and attackers can update payload URLs without altering the published extension.
The Solana wallet address BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC has received 10 configuration updates over the past month, with the most recent update occurring on January 28, 2026.
Each update delivers new server addresses hosting encrypted secondary payloads, enabling attackers to adapt their infrastructure more swiftly than defenders can respond.
This approach eliminates single points of failure and provides takedown resistance that traditional domain-based command systems cannot match.
Based on reporting by Cyber Security News.