Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities

A malicious Visual Studio Code extension, named susvsex and uploaded on 5 November 2025 by a user named suspublisher18, has been flagged as vibe-coded with basic ransomware capabilities, according to Secure Annex and The Hacker News.

The extension’s description claims it “automatically zips, uploads, and encrypts files” from a test directory on first launch, and it is designed to activate itself on events such as installation or launching VS Code, subsequently calling a function that creates a ZIP archive, exfiltrates it to a remote server, and replaces the files with encrypted versions. Microsoft removed the extension from the official VS Code Marketplace on 6 November 2025, after the disclosure.

Investigators note the package also uses GitHub as a command-and-control channel by polling a private repository for new commands, with results written back to the repository via a GitHub access token embedded in the code, and that the repository owner claims to be from Baku, Azerbaijan. The disclosure highlights that vibe-coded malware often includes decryption tools and C2 code, with comments and placeholders in the package flagged as telltale signs.