GCVE-110-OSM-2026-7004

Malicious Open VSX extension 'corotata.pptx-preview' (v1.0.1), part of the 'Count Dooku' campaign. A legitimate VS Code extension was republished to Open VSX with a malicious JavaScript IIFE appended after the normal extension output (outside the source map) to evade casual review. Published under Open VSX namespace account 'parker-edward7785'. Malicious payload: JavaScript IIFE appended to the end of the bundled extension code, after legitimate output and outside source maps. Behavior: on activation, beacons host and package metadata to the C2 — sends a generated machine ID, platform, and the extension's publisher/name/version. C2 URL: https://beststats.world/ping Persistence: writes a local identifier file at ~/.vsx-id (path.join(os.homedir(), ".vsx-id")) to track the compromised system.