GCVE-110-OSM-2026-7014

Malicious Open VSX extension 'matthiesen-technology.yaml-with-script' (v1.1.3), part of the 'Count Dooku' campaign. A legitimate VS Code extension was republished to Open VSX with a malicious JavaScript IIFE appended after the normal extension output (outside the source map) to evade casual review. Malicious payload: JavaScript IIFE appended to the end of the bundled extension code, after legitimate output and outside source maps. Behavior: on activation, beacons host and package metadata to the C2 — sends a generated machine ID, platform, and the extension's publisher/name/version. C2 URL: https://beststats.world/ping Persistence: writes a local identifier file at ~/.vsx-id (path.join(os.homedir(), ".vsx-id")) to track the compromised system.