Loading story…
Security researchers reported multiple developer supply-chain threats abusing trusted ecosystems to steal data or deliver malware. In Microsoft’s VS Code Marketplace, two AI-themed extensions—ChatGPT – 中文版 (publisher WhenSunset, ~1.34M installs) and ChatMoss (CodeMoss) (publisher zhukunpeng, ~150K installs)—were found exfiltrating developer data to China-based servers without disclosure or consent. Koi Security attributed the activity to a campaign dubbed “MaliciousCorgi,” noting shared code and common backend infrastructure; the extensions reportedly monitor files opened in VS Code and transmit full contents (Base64-encoded), including subsequent changes.
Separately, malicious PyPI packages spellcheckerpy and spellcheckpy impersonated the legitimate pyspellchecker project and embedded a Base64-encoded downloader inside a seemingly legitimate Basque dictionary resource (resources/eu.json.gz). Aikido reported the attacker first published “dormant” versions (payload present but not executed), then enabled execution in spellcheckpy v1.2.0 by adding an obfuscated trigger that runs on import/initialization (e.g., when importing SpellChecker), ultimately downloading a full-featured Python RAT. Together, the incidents reinforce the risk of installing unvetted extensions and packages, even when they appear functional and reference legitimate upstream repos.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
By January 26, 2026, Koi Security also disclosed "PackageGate," six zero-day vulnerabilities affecting npm, pnpm, vlt, and Bun that could bypass lifecycle script and lockfile integrity protections. Fixes were released for pnpm, vlt, and Bun, while npm reportedly declined to issue a fix and stated that installing git dependencies implies trust in repository contents.
When the malicious VS Code extensions were publicly reported, Microsoft had been contacted for comment and the extensions were still available in the marketplace. By January 26, Microsoft had launched an investigation, though the extensions had not yet been removed according to reporting at the time.
Koi Security reported that the two VS Code extensions, installed about 1.5 million times, covertly sent opened file contents and subsequent edits to servers in China. The extensions could also receive a server-side command to harvest up to 50 workspace files, potentially exposing source code, credentials, .env files, and configuration data.
By January 2026, Koi Security identified two malicious Visual Studio Code Marketplace extensions, ChatGPT and ChatMoss/CodeMoss, masquerading as AI coding assistants. The extensions shared the same backend infrastructure and data-stealing code, leading researchers to track the activity as the "MaliciousCorgi" campaign.
On January 20–21, 2026, a malware detection pipeline identified the malicious PyPI packages spellcheckerpy and spellcheckpy. Analysis showed the second-stage RAT performed host fingerprinting, used a custom XOR-obfuscated protocol, disabled TLS certificate validation, and beaconed every five seconds for commands including arbitrary code execution.
On January 20–21, 2026, spellcheckpy version 1.2.0 introduced obfuscated code that reconstructs and invokes exec at runtime when SpellChecker is imported or instantiated. This change activated the hidden downloader, which fetched a second-stage Python RAT from updatenet[.]work and ran it filelessly.
Before execution was enabled, the PyPI packages spellcheckerpy and spellcheckpy were published while impersonating the legitimate pyspellchecker project and linking to its real GitHub repository. These early releases contained a concealed base64-encoded stage-1 downloader in a Basque dictionary resource file, but the payload was not yet triggered.
In November 2025, HelixGuard documented a malicious PyPI campaign involving a package named "spellcheckers" that used a similar Python RAT structure but different command-and-control domains. Later analysis suggested the January 2026 packages followed the same threat actor playbook.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceaikido.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at **Aikido** identified two malicious Python packages on the Python Package Index (**PyPI**)—`spellcheckerpy` and `spellcheckpy`—masquerading as legitimate spell-checking utilities but containing hidden functionality to deliver a **remote access trojan (RAT)**. The packages were removed from PyPI after being downloaded a little over **1,000** times, highlighting ongoing software supply-chain risk in public repositories. Analysis indicates the attacker hid a Base64-encoded payload inside a Basque-language dictionary resource (`resources/eu.json.gz`) copied from the legitimate *pyspellchecker* project, rather than placing obvious malicious logic in `__init__.py`. Early releases were intentionally **dormant** (payload present but not executed), but `spellcheckpy` **v1.2.0** introduced an obfuscated execution trigger that runs on import and can be activated via a function call such as `test_file("eu", "utf-8", "spellchecker")`, which extracts the embedded downloader under a `spellchecker` key. The downloader retrieves a Python RAT from `updatenet[.]work`, a domain linked to infrastructure (including **172.86.73[.]139**) associated with malicious hosting activity, and the RAT supports host fingerprinting, command parsing, and remote command execution.
Jun 29, 2026
Security researchers at ReversingLabs have identified a sophisticated campaign in which 19 malicious Visual Studio Code (VS Code) extensions were uploaded to the VS Code Marketplace, targeting developers by hiding a Trojan within their dependency folders. The attackers modified a widely trusted npm package, `path-is-absolute`, to include malicious code that executed upon VS Code startup, ultimately decoding a JavaScript dropper concealed in a file named `lock`. The final payload was disguised as a `banner.png` file, which, despite its image extension, was actually an archive containing two malicious binaries. This campaign, active since February 2025 and discovered in December, highlights the risks of supply chain attacks in developer ecosystems. The malicious extensions either impersonated popular packages or claimed to offer new functionalities, but in reality, they executed harmful code on developers' machines. The use of legitimate dependencies as a vector for malware delivery demonstrates an evolution in threat actor tactics, making detection more difficult. Researchers also noted a broader trend of increasing malware submissions to the VS Code Marketplace, including incidents where legitimate extensions were compromised through malicious pull requests that added harmful dependencies. This incident underscores the need for heightened scrutiny of third-party code and dependencies in development environments.
Jun 29, 2026
Security researchers have identified two malicious extensions on the Microsoft Visual Studio Code Marketplace, named *Bitcoin Black* and *Codo AI*, which were designed to infect developer machines with information-stealing malware. These extensions, published under the developer name 'BigBlack', masqueraded as a premium dark theme and an AI-powered coding assistant, but secretly downloaded additional payloads, took screenshots, and exfiltrated sensitive data such as code, emails, Slack messages, WiFi passwords, clipboard contents, and browser sessions to attacker-controlled servers. Microsoft has since removed these extensions from the marketplace after their discovery, but not before they were downloaded and installed by several users. The malware leveraged PowerShell and batch scripts to download and execute payloads, with later versions hiding execution windows to evade user detection. Technical analysis revealed that both extensions delivered a legitimate Lightshot screenshot tool alongside a malicious DLL, which was loaded via DLL hijacking to deploy the infostealer under the name `runtime.exe`. The malicious DLL was detected by multiple antivirus engines and created persistence by establishing directories in the `%APPDATA%\Local\` path. The Codo AI extension embedded its malicious code within a functioning tool, making it harder to detect, while Bitcoin Black activated on every VS Code action. The campaign highlights the risks of third-party extensions in developer environments and the need for vigilance when installing tools from public marketplaces.
Jun 29, 2026