Dangerous VSCode Extensions Steal Crypto on OpenVSX
▼ Summary
– TigerJack is targeting developers through malicious extensions on VSCode marketplace and OpenVSX to steal cryptocurrency and install backdoors.
– Two removed extensions, C++ Playground and HTTP Format, were downloaded 17,000 times and are still available on OpenVSX, with TigerJack republishing them under new names.
– C++ Playground exfiltrates source code by capturing keystrokes in near-real time, while HTTP Format secretly runs a crypto miner using the host’s processing power.
– Another type of malicious extension fetches and executes arbitrary JavaScript code every 20 minutes, enabling dynamic payload delivery without updates.
– Koi Security identified TigerJack as a coordinated multi-account operation using credible disguises, and OpenVSX has not removed the extensions despite being notified.
Developers relying on the Visual Studio Code ecosystem face a growing threat from malicious extensions designed to steal cryptocurrency and establish backdoors. A threat actor known as TigerJack has been systematically uploading harmful extensions to both the official VSCode Marketplace and the community-run OpenVSX registry. Two of these extensions, C++ Playground and HTTP Format, accumulated 17,000 downloads before being removed from Microsoft’s platform, yet they remain accessible on OpenVSX. TigerJack continues to republish identical malicious code under different names, evading detection and removal efforts.
OpenVSX serves as an open-source, vendor-neutral alternative to Microsoft’s marketplace and is the default extension source for several popular VSCode-compatible editors, including Cursor and Windsurf. Researchers at Koi Security uncovered this ongoing campaign, identifying at least 11 malicious VSCode extensions distributed since the start of the year. The same two extensions deleted from VSCode have reappeared on the platform via newly created accounts, highlighting the persistent nature of the attack.
When activated, the C++ Playground extension registers a listener that monitors changes to C++ files. This listener triggers approximately 500 milliseconds after any edit, capturing keystrokes in near-real time and exfiltrating source code to multiple external servers. Meanwhile, HTTP Format performs its advertised formatting functions but also secretly runs a CoinIMP cryptocurrency miner in the background. This miner uses hardcoded credentials and configuration settings to harness the host computer’s processing power without any resource usage restrictions, potentially causing significant performance degradation.
Another set of malicious extensions, cppplayground, httpformat, and pythonformat, fetch and execute JavaScript code from a hardcoded remote address. The extensions poll the address ab498.pythonanywhere.com/static/in4.js every 20 minutes, allowing arbitrary code execution without requiring any updates to the extension itself. Researchers emphasize that this method is particularly dangerous due to its dynamic payload delivery capability. TigerJack can push any malicious payload remotely, enabling activities like credential theft, ransomware deployment, corporate network infiltration, backdoor injection into projects, or real-time activity monitoring.
Koi Security describes TigerJack as a coordinated multi-account operation that creates a false appearance of legitimacy. The attacker uses GitHub repositories, professional branding, detailed feature lists, and extension names that mimic trusted tools to appear as independent developers. Although the research team reported their findings to OpenVSX, the registry maintainer had not responded by the time of publication, and the malicious extensions remain available for download. Developers are urged to exercise extreme caution and only install extensions from verified, reputable publishers to mitigate these risks.
(Source: Bleeping Computer)