A Dangerous Loophole in the VS Code Marketplace Is Allowing Malicious Extensions

ReversingLabs researchers have uncovered a dangerous loophole in the Visual Studio Code marketplace that allows threat actors to reuse the names of previously removed extensions to distribute malware, including ransomware in development. The researchers identified malicious extensions in March, such as ahban[.]shiba and ahban[.]cychelloworld, which acted as simple loaders, with the second stage payload later described as a ransomware in development encrypting files in a test folder.

In June, a new extension named ahbanC[.]shiba appeared, and researchers noted that apart from the spelling of the extension’s unique ID, things were unchanged. The troubling finding is that the same extension name can be reused after removal, potentially enabling a threat actor to publish a malicious extension that claims the same name as a prior, legitimate extension that has been removed, according to the official VS Code Marketplace documentation.

Like its predecessors, the new extension functioned as a downloader, and the second stage payload attempted to encrypt files and demand ransom in Shiba Inu tokens, illustrating that attackers were testing ransomware delivery pipelines via the Marketplace, and highlighting broader concerns about supply chain risks in public development ecosystems as seen also in PyPI.

ReversingLabs warns that the VS Code Marketplace is becoming increasingly popular with malicious actors, who are developing new ways to trick developers and users into downloading malicious packages.