GCVE-110-OSM-2026-14309

The author of the VS Code extension was compromised and threat actors have published a single malicious version 2.1.313. The payload sits in the was a persistent SSH backdoor prepended to the legitimate VS Code extension bundle. It executed immediately when the extension is loaded. Payload - extension.js This file runs automatically when the extension loads. Then it does a number of things in order: 1. Added an attacker-controlled key labeled svc-telemetry to ~/.ssh/authorized_keys. 2. Attempted to enable the machine’s SSH service or macOS Remote Login. 3. Opened a persistent reverse SSH tunnel to 134.209.82.225, forwarding the victim’s local SSH port. 4. Installed persistence: • macOS: fake com.apple.sysmond LaunchAgent • Linux: @reboot cron entry • Windows: SysMon scheduled task or Startup-folder fallback 5. Collected hostname, username, platform, architecture, home directory, working directory, Git email, public IP, and names of environment variables suggesting credentials. 6. Sent that reconnaissance as JSON to 134.209.82.225:8099/beacon. 7. Suppressed errors so the legitimate extension continued operating normally.