GCVE-110-OSM-2026-13083

Coca-Cola Christmas is a VS Code theme (also published to Open VSX) that contains executable JavaScript unnecessary for a color theme. Socket AI Scanner classifies version 1.0.2 as known malware based on high-confidence cluster attribution, though no active payload was observed in the analyzed build. Its GitHub repository's git history is authored by the same identity (aubineherodvulbdl@outlook.com) that authored the confirmed-malicious Aurora Nocturne Night Theme source, and it has accumulated 8,000+ Marketplace installs. Malicious payload found in: extension JavaScript (no active payload triggered in analyzed version) Version: 1.0.2 Associated support email: support@holiday-themes.dev Associated domain: holiday-themes.dev Behavior: Contains executable JS scaffolding beyond what a static color theme requires. Git history for the linked GitHub repository is authored by aubineherodvulbdl@outlook.com, the same identity behind the confirmed-malicious Aurora Nocturne Night Theme, establishing a developer-identity link across the cluster.