Malicious Visual Studio Code Extensions Distribute Trojan via Fake PNG Files

Security researchers at ReversingLabs have identified a sophisticated campaign in which 19 malicious Visual Studio Code (VS Code) extensions were uploaded to the VS Code Marketplace, targeting developers by hiding a Trojan within their dependency folders. The attackers modified a widely trusted npm package, path-is-absolute, to include malicious code that executed upon VS Code startup, ultimately decoding a JavaScript dropper concealed in a file named lock. The final payload was disguised as a banner.png file, which, despite its image extension, was actually an archive containing two malicious binaries. This campaign, active since February 2025 and discovered in December, highlights the risks of supply chain attacks in developer ecosystems.

The malicious extensions either impersonated popular packages or claimed to offer new functionalities, but in reality, they executed harmful code on developers' machines. The use of legitimate dependencies as a vector for malware delivery demonstrates an evolution in threat actor tactics, making detection more difficult. Researchers also noted a broader trend of increasing malware submissions to the VS Code Marketplace, including incidents where legitimate extensions were compromised through malicious pull requests that added harmful dependencies. This incident underscores the need for heightened scrutiny of third-party code and dependencies in development environments.