← Campaigns
Count Dooku
Supply-chain campaign that re-published legitimate VS Code extensions to Open VSX with a malicious JavaScript IIFE appended after the source-map comment — placed outside the source map so casual review and diff tools miss it. The injected payload beacons to a hard-coded C2. Tracked by opensourcemalware.com.
- Extensions
- 45
- Stores
- OpenVSX
- Updated
- 2026-07-12
- Disclosed
- 2026-07-11
Member extensions
45 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| pokemon-petsAnasfiguigui.pokemon-pets | OpenVSX | 1.3.0 | Unscored |
| codebuddy-aiCodebuddyAI.codebuddy-ai | OpenVSX | 1.7.0 | 65HIGH |
| dadroit-json-generatorDadroit.dadroit-json-generator | OpenVSX | 1.2.2 | 65HIGH |
| csv-excel-viewerDevelopment42.csv-excel-viewer | OpenVSX | 1.9.0 | 65HIGH |
| competitive-programming-helperDivyanshuAgrawal.competitive-programming-helper | OpenVSX | 2026.6.1780853884 | 65HIGH |
| doubao-app-share-vscode-pluginDoubao.doubao-app-share-vscode-plugin | OpenVSX | 0.1.2 | 65HIGH |
| html-preview-proGingerTurtle.html-preview-pro | OpenVSX | 1.1.0 | 65HIGH |
| kimi-vscodeKingleo.kimi-vscode | OpenVSX | 0.0.6 | 65HIGH |
| claude-color-themeLumidew.claude-color-theme | OpenVSX | 0.0.6 | 65HIGH |
| vscode-paste-and-indentRubymaniac.vscode-paste-and-indent | OpenVSX | 0.0.8 | 65HIGH |
| docxreaderShahilKumar.docxreader | OpenVSX | 1.4.2 | 65HIGH |
| Document-Viewer-VSCode-ExtensionsSyncfusionInc.Document-Viewer-VSCode-Extensions | OpenVSX | 4.0.4 | Unscored |
| open-excelTomRileyTech.open-excel | OpenVSX | 0.0.1 | 65HIGH |
| vscode-1c-metadata-viewerZerobig.vscode-1c-metadata-viewer | OpenVSX | 0.2.3 | 65HIGH |
| gemini-cli-launcheracebunny00.gemini-cli-launcher | OpenVSX | 0.1.0 | 65HIGH |
| node-essentialsafractal.node-essentials | OpenVSX | 1.1.0 | 65HIGH |
| a-file-icon-vscodeatommaterial.a-file-icon-vscode | OpenVSX | 2.0.1 | Unscored |
| markitdown-vscodebioinfo.markitdown-vscode | OpenVSX | 0.3.1 | 65HIGH |
| vscode-ripgrepbokuweb.vscode-ripgrep | OpenVSX | 0.2.2 | 65HIGH |
| vscode-deepseekcolourafredi.vscode-deepseek | OpenVSX | 1.6.2 | 65HIGH |
Indicators
Download STIX →Browse 5 indicators
| Type | Value & evidence |
|---|---|
| url | https://beststats.world/pingC2 beacon endpoint reached by the appended payload |
| domain | beststats.worldCount Dooku C2 domain |
| ext_id | openvsx-namespace:a373083284542Attacker Open VSX publisher namespace (multi-extension) |
| ext_id | openvsx-namespace:henry-davis-5045Attacker Open VSX publisher namespace |
| ext_id | openvsx-namespace:dwells3532Attacker Open VSX publisher namespace |