← Campaigns
Count Dooku
Supply-chain campaign that re-published legitimate VS Code extensions to Open VSX with a malicious JavaScript IIFE appended after the source-map comment — placed outside the source map so casual review and diff tools miss it. The injected payload beacons to a hard-coded C2. Tracked by opensourcemalware.com.
- Extensions
- 45
- Stores
- OpenVSX
- Updated
- 2026-07-12
- Disclosed
- 2026-07-11
Member extensions
45 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| markdown-pdf-plustom-latham.markdown-pdf-plus | OpenVSX | 1.1.0 | 65HIGH |
| cursor-aivbrocket.cursor-ai | OpenVSX | 0.2.0 | 65HIGH |
| vscode-ollamawarm3snow.vscode-ollama | OpenVSX | 1.2.1 | 65HIGH |
| obsidian-md-vscwillasm.obsidian-md-vsc | OpenVSX | 1.3.0 | 65HIGH |
| luahelperyinfei.luahelper | OpenVSX | 0.2.29 | 65HIGH |
Indicators
Download STIX →Browse 5 indicators
| Type | Value & evidence |
|---|---|
| url | https://beststats.world/pingC2 beacon endpoint reached by the appended payload |
| domain | beststats.worldCount Dooku C2 domain |
| ext_id | openvsx-namespace:a373083284542Attacker Open VSX publisher namespace (multi-extension) |
| ext_id | openvsx-namespace:henry-davis-5045Attacker Open VSX publisher namespace |
| ext_id | openvsx-namespace:dwells3532Attacker Open VSX publisher namespace |