VS Code Supply Chain Attack: 19 Extensions Used Typosquatting & Steganography to Deploy Rust Trojan

According to ReversingLabs researchers, a sophisticated VS Code supply chain campaign has been active since February 2025 and was discovered on 2 December 2025, involving 19 malicious extensions that bypassed standard detection by burying payloads inside dependency folders. The attackers used typosquatting-adjacent techniques and steganography to conceal their malicious code, including a deceptive file named banner[.]png that actually contained an archive with two malicious binaries.

The threat actors tampered not with the official npm package on the registry, but with the version bundled inside each extension, turning a widely trusted package into a ticking timebomb once the extension runs. The attack chain starts when the compromised dependency’s index.js executes at VS Code startup, decoding a JavaScript dropper from a file named lock, which then unpacks the payload from the fake PNG and uses cmstp.exe to execute the binaries. One of the binaries emulates key presses, while the other is described as a “more complicated Rust trojan” whose full capabilities are under review.