Security Alert: 19 Fake PNG Extensions Found in VS Code Marketplace

Overview of Malicious Visual Studio Code Extensions

ReversingLabs researchers have identified a supply chain campaign involving 19 malicious Visual Studio Code (VS Code) extensions. Active since February 2025 and revealed on Tue, Dec 2, 2025, the campaign exploits the developer ecosystem by embedding malware within dependency folders of legitimate extensions.

The attackers utilized a novel evasion technique, concealing malicious binaries inside files disguised as PNG images.

The campaign saw a rise in malware submissions to the VS Code Marketplace throughout 2025. Unlike previous methods using malicious pull requests, this operation leverages the architectural differences between standard npm package installations and VS Code extensions.

Standard npm installations fetch dependencies from a remote registry at runtime. VS Code extensions are pre-packaged with a node_modules folder, containing all necessary dependencies.

Threat actors exploited this pre-packaged structure to modify local versions of popular libraries without affecting official packages on npm. Specifically, they altered the path-is-absolute package, which has over 9 billion cumulative downloads. Changes were confined to the bundled extension, leaving the npm repository unaffected while the extension carried the malicious code.

The technical execution of the attack involves a multi-stage infection chain within the modified dependency. The attackers altered the index.js file of path-is-absolute to include a new class initiating the malware. This class executes code upon VS Code startup, decoding a JavaScript dropper hidden in a file named lock . The dropper is obfuscated through base64 encoding and reversed character strings to evade static analysis.

When the extension runs, the decoded dropper extracts binaries and executes them using cmstp.exe , a legitimate Windows "Living-of-the-Land" binary (LOLBIN). One binary emulates key presses to close the LOLBIN window, while the second is a complex Rust-based trojan under analysis.

While most extensions targeted path-is-absolute , four extensions targeted the @actions/io package instead. In these cases, the PNG disguise was not used; the binaries were split into files masquerading as TypeScript (.ts) and sourcemap (.map) files.

Component File Type Function in Attack Chain

path-is-absolute npm Package Legitimate dependency modified locally to host malicious logic.

banner.png Archive Fake image file containing the Rust trojan and helper binaries.

lock Obfuscated File Contains the reversed, base64-encoded JavaScript dropper.

index.js Script Modified entry point that triggers the decoding of the lock file.

cmstp.exe LOLBIN Legitimate Windows tool abused to execute the extracted payload.

@actions/io npm Package Alternative target package used to hide malware in .ts and .map files.

A critical component of this campaign is a file named banner.png . Although appearing to be a standard image asset for the extension, ReversingLabs researchers discovered it was an archive containing malicious binaries. This incident highlights a trend of attackers targeting developer environments.

Data from ReversingLabs shows detections of malicious software on the VS Code Marketplace increased from 27 instances in 2024 to 105 in the first ten months of 2025. Security experts recommend development teams rigorously audit extensions, especially those with low install counts or recent publish dates.

Since malware can reside deep within the node_modules hierarchy rather than the main extension code, automated security tooling and deep inspection of packaged dependencies are essential for a secure development pipeline.

Based on reporting by GBHackers.