Malicious VSX Extension "SleepyDuck" Uses Ethereum to Keep Its Command Server Alive

Cybersecurity researchers flagged a new malicious VSX extension in the Open VSX registry, named juan-bianco[.]solidity-vlang (version 0.0.7), which was updated to 0.0.8 on 1 November 2025 to add malicious capabilities after reaching 14,000 downloads, according to Secure Annex’s John Tuckner. The malware is a remote access trojan that includes sandbox evasion techniques and uses an Ethereum contract to update its command-and-control address if the original is taken down, Tuckner added.

When triggered by opening a new code editor window or selecting a .sol file, the extension connects to the fastest Ethereum RPC provider to reach a remote server at sleepyduck[.]xyz via the contract address 0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465, and then starts polling for commands every 30 seconds while collecting host information for exfiltration.

The contract was created on 31 October 2025, and the threat actor updated the server details from localhost:8080 to sleepyduck[.]xyz across four transactions, with built-in fallback Ethereum RPC addresses to retrieve contract information if the domain is seized. The development comes as part of broader campaigns distributing rogue extensions across Open VSX and the Visual Studio Code Marketplace.