Full Report
Malicious campaigns targeting VSCode extensions have recently expanding to npm, risking software supply chains
Analysis Summary
# Tool/Technique: Malicious VSCode Extensions and npm Packages (Supply Chain Compromise)
## Overview
A threat campaign identified in late 2024 that exploits both VSCode extensions and npm packages to compromise local development environments and introduce risks into the software supply chain. These malicious components contain obfuscated payloads designed to further compromise systems.
## Technical Details
- Type: Malware/Technique (Supply Chain Attack Vector)
- Platform: Development Ecosystems (VSCode, npm/Node.js ecosystem)
- Capabilities: Initial execution via development tools; downloading and executing secondary malicious components; targeting cryptocurrency communities initially, then broadening scope (e.g., impersonating Zoom).
- First Seen: Detected in late 2024 (with expansion from VSCode Marketplace to npm).
## MITRE ATT&CK Mapping
This campaign primarily leverages the initial stages of the attack lifecycle:
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise (Indirectly, via downloading and executing malicious dependencies)
- **TA0002 - Execution**
- T1059.006 - Command and Scripting Interpreter: Python (Often involves downstream scripts executed by npm)
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell (If payloads target Windows)
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
## Functionality
### Core Capabilities
- **Ecosystem Abuse:** Malicious code injected directly into legitimate-looking packages distributed via the VSCode Marketplace and the npm registry.
- **Initial Payload Delivery:** The packages contain obfuscated JavaScript payloads.
- **Secondary Payload Download:** Obfuscated scripts are designed to download and execute additional malicious components.
- **Social Engineering:** Threat actors used inflated install counts and fabricated reviews to gain user trust.
### Advanced Features
- **Impersonation:** Targeting initial users (cryptocurrency community) and later impersonating widely used applications like Zoom.
- **Domain Mimicry:** Use of domains mimicking trusted sources, such as “microsoft-visualstudiocode\[.\]com”.
- **Obfuscation:** Extensive use of obfuscated JavaScript to evade static analysis detections.
## Indicators of Compromise
- File Hashes: [Not detailed/provided in the context]
- File Names: Malicious npm package variant mentioned: `etherscancontracthandler` (five versions identified).
- Registry Keys: [Not detailed/provided in the context]
- Network Indicators: Shared common endpoints; domains mimicking trusted sources, such as `microsoft-visualstudiocode[.]com` (defanged).
- Behavioral Indicators: Execution of highly obfuscated JavaScript code upon installing the extension/package; network connections originating from the development environment to known C2 infrastructure.
## Associated Threat Actors
- The report suggests the same undisclosed threat actor or group created both the compromised VSCode extensions and the malicious npm packages due to observed similarities.
## Detection Methods
- Signature-based detection: Less effective due to heavy use of obfuscation.
- Behavioral detection: Monitoring unexpected network connections initiated by VSCode or npm scripts, especially those downloading secondary executables. Checking build/development operations for execution of obfuscated scripts.
- YARA rules: Rules could be developed to detect specific obfuscation patterns or strings common across the identified paylods.
## Mitigation Strategies
- **Audit and Validation:** Regularly audit plugins and dependencies for vulnerabilities.
- **Pre-Approval:** Validate and pre-approve development tools and extensions before deployment or use within the development environment.
- **Security Assessments:** Conduct frequent security assessments to identify new risks introduced by third-party libraries/updates.
- **Dependency Scrutiny:** Development organizations must scrutinize the features and behaviors of open-source, third-party, and commercial code they rely on to track dependencies and detect potential malicious payloads.
- **Source Verification:** Be cautious of dependencies from public repositories; developers should look for indicators of malicious code inclusions.
## Related Tools/Techniques
- **Supply Chain Attacks:** Broader category including other repository compromises (e.g., PyPI attacks mentioned in related articles).
- **Typosquatting and Repojacking** (Mentioned in related articles, relevant for initial compromise tactics).
- **Malicious npm Packages:** Similar attacks targeting the Node Package Manager ecosystem.