Fallout in vscode, Aug 17 – Aug 23

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

THURSDAY

Thu Aug 20 · 2 catches · 0 waves · 2 singles
micro-behaviors/processmicro-behaviorsmetadatametadata/importobjectives/anti-staticmicro-behaviors/datamicro-behaviors/uimicro-behaviors/communicationsmicro-behaviors/fsobjectives/supply-chainobjectives+3 35d
Swimlane vscode StackStudios.swimlane 1,184 installs ✓ 35 days ago

obfuscated preinstall dropper payload

dropper/setup-hooksupply-chain/typosquat
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/persistenceobjectives/evasionmicro-behaviors/processobjectivesobjectives/exfiltration+17 35d
Anti Tools 1.16.2 vscode Felix2CN/anti-tools 16,071 installs 35 days ago

Credential theft, CDP, evasion

messaging/telegramprocess/name

WEDNESDAY

Wed Aug 19 · 1 catch · 0 waves · 1 single
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/discoveryobjectives/impactobjectivesobjectives/credential-access+24 36d
MyFlicker 10.0.2608150 vscode kuaishou/kwaipilot 7,621 installs 36 days ago

Browser hijack, data theft, VM evasion

dev-tools/aiservices/stop

TUESDAY

Tue Aug 18 · 1 catch · 0 waves · 1 single
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/buildmetadataobjectives/exfiltrationobjectives/anti-analysisobjectives/command-and-controlobjectivesobjectives/execution+17 36d
Grok Build for VS Code (Community) 3.12.4 vscode PawelHuryn/grok-vscode-phuryn 56,194 installs 36 days ago

clipboard shell loader planted

lure/clipboardexecution/clickfix

MONDAY

Mon Aug 17 · 2 catches · 0 waves · 2 singles
well-known/appwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/buildmetadataobjectives/evasionobjectives/supply-chainobjectives/persistenceobjectives/credential-accessobjectives+18 37d
Test Companion 1.29.11 vscode browserstackcom.test-companion 36,875 installs 37 days ago

AI coding tool secret harvesting

dev-tools/ai
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/anti-staticobjectives/anti-analysisobjectives/command-and-controlobjectives/executionobjectives+16 38d
Deeptask: AI Coding Agent…ot, and Autocomplete 9.0.8 vscode deeptask/deeptask 4,483 installs 38 days ago

CDP browser hijack and control

exploit/debug-interfacecontrol/hvnc
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories