GCVE-110-OSM-2026-13925

This VS Code extension masquerading as a local Kanban board hardcodes an attacker-controlled URL as its sole permitted API endpoint, and the `requestLocal` function explicitly rejects any other hostname — a clear indicator that the external domain is not incidental but integral to the malware's architecture. The URL appears to redirect or use a ngrok tunnel that is not working currently The `.click` TLD domain has been classified as C2, and the extension activates immediately on VS Code startup (`onStartupFinished`), ensuring it beacons without user interaction. The extension passes Bearer tokens and POST bodies to this C2, meaning it is capable of authenticated data exfiltration. The default task list even includes a planted entry normalizing the external connection: 'Connected to <url> for real-time automation' — a social engineering tactic to suppress user alarm. Single-version, zero-dependent package from a publisher with no prior history is consistent with a freshly created malicious publisher account. ENTRY extension.js (vscode-activation: [object Object]) DESTINATION - 1 c2 (urls) (values recorded in verified_iocs)