VS Code Marketplace Abused by Threat Actors to Deliver Malware via Trusted Extensions

A recently uncovered flaw in the VS Code Marketplace has allowed malicious actors to hijack discontinued extension names and slip malware past developers, according to ReversingLabs (RL) researchers. In March RL identified two extensions, ahban[.]shiba and ahban[.]cychelloworld, that downloaded and executed a nascent ransomware module, encrypting files in a test folder and demanding payment in Shiba Inu cryptocurrency; the extensions were promptly removed from the Marketplace.

In June RL spotted ahbanC[.]shiba, which functioned identically but carried a different publisher name, and its single command shiba[.]aowoo downloaded a PowerShell script from a remote server to encrypt files on the victim’s Desktop test folder. The loophole arises because the Marketplace’s uniqueness checks apply only to unpublished extensions, not to removed ones, allowing names of removed extensions to be repurposed by new actors, a risk RL says mirrors patterns seen on other open-source platforms.

RL notes that the name-reuse loophole underscores a broader supply-chain risk and recommends monitoring extension origins, enabling code signing and reviews, and using security tools such as Spectra Assure Community to scan marketplace risks.