Fallout in vscode, Aug 24 – Aug 30

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SATURDAY

Sat Aug 29 · 1 catch · 0 waves · 1 single
well-known/librarywell-knownmicro-behaviorsmicro-behaviors/browser-extensionmetadatametadata/binaryobjectives/command-and-controlobjectives/persistenceobjectives/anti-staticobjectives/supply-chainobjectives+19 26d
Power Agents 3.0.143 vscode neural-llm/power-claude 8,594 installs 26 days ago

Obfuscated credential theft and persistence

hidden-payload/runtimeobfuscator/js-obfuscator

FRIDAY

Fri Aug 28 · 2 catches · 0 waves · 2 singles
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importmicro-behaviors/datamicro-behaviors/osobjectives/command-and-controlobjectivesobjectives/exfiltration+11 27d
S-Git 0.0.6 vscode qobyn/s-git 114 installs 27 days ago

Exfiltrates files to Telegram C2.

messaging/telegramchannel/messaging
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importmicro-behaviors/datamicro-behaviors/osobjectives/command-and-controlobjectivesobjectives/exfiltration+8 27d
S-Git 0.0.5 vscode qobyn/s-git 27 days ago

Exfiltrates files via hardcoded Telegram bot

messaging/telegramchannel/messaging

WEDNESDAY

Wed Aug 26 · 1 catch · 0 waves · 1 single
objectivesobjectives/anti-staticwell-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadata/binarymetadataobjectives/command-and-controlobjectives/supply-chainwell-known/tool+16 29d
WorkspaceGPT 2.0.15 vscode Riteshkant/workspacegpt-extension 7,317 installs 29 days ago

XSS injection in htmlescape dependency

TUESDAY

Tue Aug 25 · 1 catch · 0 waves · 1 single
well-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/importobjectives/collectionobjectives/credential-accessobjectives/command-and-controlobjectivesobjectives/execution+17 30d
AKC CCC VS - Context Control Center 0.2.75 vscode ready-4-it/akc-ccc-vs 2,107 installs 30 days ago

hidden PowerShell, persistence, process injection

script/wshdropper/node-bootstrap
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories