← Campaigns
Count Dooku
Supply-chain campaign that re-published legitimate VS Code extensions to Open VSX with a malicious JavaScript IIFE appended after the source-map comment — placed outside the source map so casual review and diff tools miss it. The injected payload beacons to a hard-coded C2. Tracked by opensourcemalware.com.
- Extensions
- 45
- Stores
- OpenVSX
- Updated
- 2026-07-12
- Disclosed
- 2026-07-11
Member extensions
45 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| pptx-previewcorotata.pptx-preview | OpenVSX | 1.0.1 | Unscored |
| sql-server-profiler-toolepolicardo.sql-server-profiler-tool | OpenVSX | 0.5.1 | Unscored |
| vscode-fabricfabric.vscode-fabric | OpenVSX | 0.39.18 | 65HIGH |
| hostinger-connectorhostinger-official.hostinger-connector | OpenVSX | 1.2.3 | 65HIGH |
| web-viewerhss.web-viewer | OpenVSX | 0.0.2 | 65HIGH |
| node-runnerhuanent.node-runner | OpenVSX | 1.0.2 | 65HIGH |
| claude-commitjuajnnlb.claude-commit | OpenVSX | 1.0.4 | 65HIGH |
| claude-commitjuanlb.claude-commit | OpenVSX | 1.0.1 | 65HIGH |
| plan-umljustuskarlsson.plan-uml | OpenVSX | 0.0.8 | 65HIGH |
| protobufkangping.protobuf | OpenVSX | 1.1.6 | 65HIGH |
| vscode-openrouter-extensionkhaled.vscode-openrouter-extension | OpenVSX | 0.5.0 | 65HIGH |
| yaml-with-scriptmatthiesen-technology.yaml-with-script | OpenVSX | 1.1.3 | 65HIGH |
| Lispmattn.Lisp | OpenVSX | 0.1.12 | 65HIGH |
| streamlit-previewmjethwa-streamlit.streamlit-preview | OpenVSX | 3.3.4 | 65HIGH |
| csv-to-tablephplasma.csv-to-table | OpenVSX | 1.4.1 | 65HIGH |
| vscode-playwright-test-runnersakamoto66.vscode-playwright-test-runner | OpenVSX | 1.4.1 | Unscored |
| json-serversarthikbhat.json-server | OpenVSX | 0.0.4 | 65HIGH |
| md-editorseepine.md-editor | OpenVSX | 0.1.1 | 65HIGH |
| bazel-vscodesfdc-eng.bazel-vscode | OpenVSX | 0.26.106021821 | 65HIGH |
| office-editorshubhamprajapati1202.office-editor | OpenVSX | 1.0.1 | 65HIGH |
Indicators
Download STIX →Browse 5 indicators
| Type | Value & evidence |
|---|---|
| url | https://beststats.world/pingC2 beacon endpoint reached by the appended payload |
| domain | beststats.worldCount Dooku C2 domain |
| ext_id | openvsx-namespace:a373083284542Attacker Open VSX publisher namespace (multi-extension) |
| ext_id | openvsx-namespace:henry-davis-5045Attacker Open VSX publisher namespace |
| ext_id | openvsx-namespace:dwells3532Attacker Open VSX publisher namespace |