Researchers Find Malicious VS Code, Go, npm, and Rust Packages Stealing Developer Data

Researchers have uncovered two malicious Visual Studio Code extensions plus related malware activity across Go, npm and Rust ecosystems that steal developer data. The VS Code extensions masquerade as a premium dark theme and an AI coding assistant, but their covert functionality downloads payloads, takes screenshots and exfiltrates data to an attacker‑controlled server, with one variant activating on every VS Code action.

The extensions were BigBlack[.]bitcoin-black (16 installs) and BigBlack[.]codo-ai (25 installs), both removed by Microsoft in early December 2025, with a third package, BigBlack[.]mrbigblacktheme, also deleted from the same publisher. According to Koi Security’s Idan Dardikman, a later version inadvertently displayed a PowerShell window, though subsequent iterations hid the window and used a batch script to fetch a rogue DLL via curl for data collection, cookies, and browser session hijacking.

Separately, Socket researchers flagged malicious Go, npm and Rust packages: two Go packages allegedly exfiltrate data to a paste site when a function named “valid” is invoked, hundreds of npm packages with “elf-stats-” styling exist, and a Rust crate named finch-rust acts as a loader for a sha-rust payload, while Sha-rust provides the credential theft payload.