Researchers found malicious VS Code extensions and Go, npm, and Rust packages stealing developer data via hidden payloads and exfiltration.

Malicious VS Code extension ‘susvsex’ acted as ransomware and used GitHub for command control Extension appeared AI-generated, with embedded decryption keys and suspicious metadata Microsoft removed ...

A seven-year malicious browser extension campaign infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware sending people's data to servers in China.

A new malware campaign is A/B testing delivery effectiveness on software developers using malicious VS Code extensions.

A threat actor has published over a hundred malicious extensions that can track and profile Chrome and Microsoft Edge users ...