GCVE-110-OSM-2026-12697

On activation, the extension collects host identity information and periodically sends it to a remote endpoint over plain HTTP. Malicious behavior found in: /tmp/osmalyze/vscode/AzureCdnInfo.edrtester@1.0.4/edrdrill.js The extension sends a JSON POST containing the hostname, locally resolved IP address, and timestamp to the /bcon/ path over HTTP port 80. The active request uses domain fronting, placing the C2 hostname in the Host header while connecting to a separate HTTP destination. Two additional beacon host values appear only in comments and are inactive in this version. The server response is parsed and logged but is not executed. A TCP reverse-shell function is present but has no callers in the supplied code.