GCVE-110-OSM-2026-13926

This VS Code extension implements a RAT-adjacent architecture: it spawns a local HTTP action server, then creates a public ngrok or Cloudflare tunnel that makes that server reachable from the internet, with an attacker-controlled url hardcoded as the default domain for all API traffic. The `endpoint()` function in `src/extension.js` enforces routing to this domain (with a nominally broad HTTPS bypass that still defaults to the operator domain), and `server.js` ships with a default admin password of `supersecret123`. The operator of the C2 domain could reach back through the tunnel and issue arbitrary code-execution commands into the user's Roblox Studio environment. The MCP/AI-relay concept is legitimate and the extension reads only developer configuration env vars (not credentials), so this stops short of confirmed malicious exfiltration; however, the brand-new zero-package publisher, single-version lifecycle, suspicious domain, and tunnel-relay architecture together create a strong suspicion of a backdoored developer tool. Manual inspection of the action-api server and what commands the C2 is permitted to issue is needed before this can be cleared ENTRY src/extension.js (vscode-activation: [object Object]) DESTINATION - 6 exfil (tunnel, custom-c2) - 2 c2 (urls) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in runtime/rbxforge/authoring/vfx.mjs: "process.env.RBXFORGE_PROJECT_ROOT ?? resolve(here,'../..'); const source=readFil..." - Environment Variable Exfiltration in runtime/scripts/doctor.mjs: "process.env.RBXFORGE_PORT ?? 35001}`; try { const response = await fetch" - Environment Variable Exfiltration in src/server.js: "process.env.CLOUDFLARE_TUNNEL_URL || process.env.TUNNEL_URL || process.env.PUBLI..." ADDITIONAL FINDINGS - Shell Command Execution in runtime/rbxforge/cli/check.js: "spawnSync(" PAYLOAD FILES runtime/rbxforge/authoring/vfx.mjs (+ runtime/scripts/doctor.mjs, src/server.js)