The ASCII-art duck gave it away. A malware family Yeeth Security first caught as a tiny JavaScript loader on Open VSX in 2025 is back — and it grew up. Two fake Solidity extensions now ship a 205 MB video concealing a compiled four-platf...
Read Full Briefing
Threat Intel
Checking npm package versions is one of the most common things a developer extension does. Six of them showed up from one publisher in un...
Read Briefing
Threat Intel
Two project-flow extensions sit quietly for five minutes after you open your editor. Then they reach out to a free DuckDNS subdomain over...
Read Briefing
Threat Intel
A single-file VS Code extension on the Microsoft Marketplace impersonates Copilot, DeepSeek, PyPI and KeyBank. On activation it phones gi...
Read Briefing
Threat Intel
Everyone wants a Kanban board inside their editor. Fifteen fake ones hit the Marketplace over ten weeks, each one a different publisher a...
Read Briefing
Threat Intel
A Kanban board for Roblox developers sounds harmless enough. Six of them hit the VS Code Marketplace in three days — same version, same s...
Read Briefing
Threat Intel
Yeeth Security found 28 counterfeit extensions on Open VSX that exfiltrate the editor, hostname and extension identity to a remote server...
Read Briefing
Threat Intel
Yeeth Security tracked a multi-version VS Code: extension campaign that posed as a Solidity tool. Early versions dropped an encrypted Pyt...
Read Briefing
Security Research
Most organizations can now generate a software bill of materials (SBOM), but few can turn it into a clean, remediated release. The supply...
Read Briefing
Threat Intel
A language extension called lotse-language-vscode shows up at version 13.37 — leet for elite. It declares one command: Hello World. And o...
Read Briefing
Malware Analysis
The VS Code extension ascii-fetcher.ascii-fetcher looked harmless because almost all of its code lived in a dependency. That dependency, ...
Read Briefing
Threat Intel
In late June Argus caught a cluster of VS Code: droppers that all abused Windows installer primitives — curl|bash, irm|iex, cscript, msht...
Read Briefing
Malware Analysis
The worldline.aicodefix campaign downloads a counterfeit VCRUNTIME140.dll from a fake Microsoft domain, plants it inside a spoofed Edge u...
Read Briefing
Malware Analysis
The DigitalBarberTrim.html-entity-codec campaign version-cycled through clean, malicious, and stub releases. The payload was a hidden i.j...
Read Briefing
Threat Intel
A VS Code: extension promising one sidebar for Claude, GPT, Gemini and DeepSeek instead runs a zero-width-obfuscated command that downloa...
Read Briefing
Threat Intel
A fake Solidity language extension hid in VS Code: for weeks before activating. Once it did, it scraped the clipboard for crypto seeds an...
Read Briefing
Threat Research
Malicious VS Code and Open VSX extensions are now embedding fake system instructions and context floods aimed directly at the AI-powered ...
Read Briefing
Malware Analysis
A retro-hunt across Argus scan history tied the ShopifySTORES Replit MSI dropper and the State Diagram STDX dropper to the same builder k...
Read Briefing
Malware Analysis
Argus caught a variation of the GLASSWORM campaign and flagged seven malicious extension names. We uncover what the TinyGo-compiled WebAs...
Read Briefing
Malware Analysis
Twenty-six versions of the same VS Code extension, each testing a different concealment technique. One of them hid its PowerShell downloa...
Read Briefing
Threat Intel
A notebook productivity tool turns into a full remote access implant whose architecture overlaps with two documented DPRK campaigns — Con...
Read Briefing
Malware Analysis
A new wave on Open VSX, a two-tier Solana dead-drop, and a Go-based backdoor.
Read Briefing
Security Research
Yeeth Security has been added to the Open VSX Security Hall of Fame as a security guardian. A look at the work that led here, and what it...
Read Briefing
Security Research
What developer-environment threats look like in 2026, and the controls security leaders should put in place. Written by Yeeth Security fr...
Read Briefing
Threat Intel
Sixteen extensions in 48 hours. All share one author. A forensic walkthrough of how Bane, Yeeth Security's threat-intelligence knowledge ...
Read Briefing
Threat Intel
A campaign of VS Code extensions using GitHub releases as a payload delivery mechanism — and blockchain RPCs as command-and-control
Read Briefing
Threat Intel
Analyzing a Massive 174-Account Surge on Open VSX
Read Briefing
Threat Intel
Dissecting a Downloader Abusing Extension Packs for Stealthy Distribution
Read Briefing
Year in Review
A look back at what we did and where we are going.
Read Briefing
Security Research
Why scalable secret detection is a systems problem that matters
Read Briefing
Malware Analysis
Dissecting an Obfuscated Downloader with Anti-analysis Guardrails
Read Briefing
Malware Analysis
Technical analysis a new iteration of SleepyDuck, a tiny loader that behaves like a backdoor.
Read Briefing
Malware Analysis
Technical analysis of one of the early WhiteCobra samples in the wild.
Read Briefing