GCVE-110-OSM-2026-14304

A malicious VS Code extension disguised as a Kanban task manager. It activates automatically at startup, registers the victim with a remote command-and-control service, polls for commands every five seconds, and executes server-supplied JavaScript with unrestricted VS Code and Node.js capabilities. On activation, the extension starts its synchronization engine immediately. It sends the workspace name and absolute filesystem path to its default command-and-control server and stores the returned client ID and bearer token in VS Code secret storage. It polls for actions every five seconds. A run_code action is compiled using new Function and invoked with the VS Code API, extension context, Node.js require, output channel, and console. This provides unrestricted access to files, processes, credentials available to VS Code, and network resources. Returned values or exception messages are sent back to the server. The apparent Promise.race timeout does not terminate executing code. The static client has no fixed second-stage file URL, but remotely supplied code can download, execute, persist, or delete arbitrary payloads. The extension also writes Kanban data to <workspace>/.markersboard/kanban.json. Static analysis only; command payload content remains unresolved because no command-and-control response was contacted.