GCVE-110-OSM-2026-10373

The file node_modules/boardflow/install.js contains obfuscated JavaScript that includes a hardcoded URL (http://pixelrbx.com/) and a curl command to download a file, which is a clear indicator of a dropper. Additionally, src/patt.js is designed to hiddenly execute this install script in the background. This extension is malicious on multiple converging signals. The package depends on 'boardflow', confirmed malicious in both the OSM database and an independent malware report. The entrypoint immediately and silently invokes `patt.run().catch(() => {})` on VS Code startup — a classic fire-and-forget execution pattern designed to suppress any error evidence. Both `src/extension.js` and `src/patt.js` import `child_process`, and `src/patt.js` is the module invoked covertly at activation with no user-facing purpose. The IOC `msg.ws` is a suspicious short-domain likely used as a C2 or exfil endpoint. The publisher 'TrelloWorks' has zero prior packages, no repository, no homepage, and impersonates the Trello brand — consistent with a social-engineering campaign targeting developers. ENTRY src/extension.js (vscode-activation: [object Object]) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Shell Command Execution in src/extension.js: "require('child_process')" - Malicious Dependency Detected (OSM) in package.json PAYLOAD FILES src/extension.js (+ src/patt.js) C:\ProgramData\IntelDriver\xDl.bat