Skip to content
Breaking
Latest technical intelligence from Northeast India • Infrastructure, AI, Cloud & Security Analysis • Precision Analysis | Raw Intelligence | Your North Star of Tech Latest technical intelligence from Northeast India • Infrastructure, AI, Cloud & Security Analysis • Precision Analysis | Raw Intelligence | Your North Star of Tech
SECURITY

Analysis: Malicious VS Code AI Extensions with 1.5 Million Installs Steal Developer Source Code

Malicious AI-Powered VS Code Extensions: A Hidden Threat

The Unseen Danger of AI-Powered Coding Assistants

In a concerning turn of events, cybersecurity researchers have discovered two malicious Microsoft Visual Studio Code (VS Code) extensions posing as AI-powered coding assistants. These seemingly helpful tools, with over 1.5 million combined installs, are secretly stealing developer data and sending it to servers in China.

Identical Malware, Different Publishers

The two malicious extensions, ChatGPT and ChatMoss CodeMoss, have been found to contain identical malicious code, despite being published under different names. This covert activity has been codenamed MaliciousCorgi.

Stealing Data without Suspicion

What makes this activity particularly dangerous is that the extensions function as expected, providing autocomplete suggestions and explaining coding errors. This makes them less likely to raise any red flags, keeping users' suspicion at bay.

Exfiltrating Data and Fingerprinting Devices

The embedded malicious code reads all contents of every file being opened, encodes it in Base64 format, and sends it to a server in China. The process is triggered for every edit. Additionally, the extensions incorporate a real-time monitoring feature that can exfiltrate up to 50 files in the workspace upon remote triggering.

Furthermore, a hidden zero-pixel iframe in the extension's web view loads four commercial analytics software development kits (SDKs) to fingerprint devices and create extensive user profiles. These SDKs include Zhuge.io, GrowingIO, TalkingData, and Baidu Analytics, all based in China.

PackageGate Flaws Affect JavaScript Package Managers

In a related development, the supply chain security company Koi Security has identified six zero-day vulnerabilities in JavaScript package managers like npm, pnpm, vlt, and Bun. These flaws, collectively named PackageGate, could be exploited to bypass security controls and hijack package installations.

While some of these vulnerabilities have been addressed in the affected package managers, npm has chosen not to fix one of the vulnerabilities, stating that users are responsible for vetting the content of packages they install.

Implications for North East India and Beyond

The MaliciousCorgi campaign and PackageGate vulnerabilities underscore the importance of supply chain security in the digital age. As more and more businesses in North East India and across India rely on software tools for their operations, the risk of such covert attacks increases.

Organizations must take proactive steps to secure their software supply chains, including vetting third-party extensions and packages, disabling scripts during installation, and committing lockfiles. Regular security audits and updates are also crucial in maintaining a secure digital environment.

A Call for Vigilance and Informed Choices

As the digital landscape continues to evolve, so too will the tactics of malicious actors. It is essential for users and organizations to stay vigilant, make informed choices about the software they use, and prioritize security measures to protect their data and digital assets.