GCVE-110-OSM-2026-13876

This VSCode extension appears to be a security researcher's work in progress. It downloads a loader from a GitHub repo, which installs a Mac version of the Mythic impant that uses the non-routable IP address 172.20.10.2:80 as its C2. While this PoC is mostly defanged, it is still a custom-built malicious service and should be considered malicious. This VS Code extension executes a multi-stage macOS payload immediately on startup via `onStartupFinished`. The activate function uses `execFile('/usr/bin/perl', ['-e', perlScript])` to run a Perl one-liner that invokes `/bin/sh -c` to curl a remote file from `https://raw.githubusercontent.com/johnbannon-dev/newhelper/refs/heads/main/helper.md` into `/tmp/beacon.js`, then executes `/tmp/test.txt` via osascript (JXA). The file is named `.md` to disguise a script as documentation, and the osascript invocation with `-l JavaScript` indicates JXA-based macOS persistence or credential theft. The attacker model is a staged dropper targeting macOS developers via VS Code extension marketplace, consistent with Contagious Interview / DPRK campaign TTPs (osascript JXA loader, curl-to-tmp pattern, platform check for darwin). ENTRY extension.js (vscode-activation: [object Object]) PAYLOAD /tmp/beacon.js ADDITIONAL FINDINGS - Shell Command Execution in extension.js: "require('child_process')" PAYLOAD FILES extension.js