Threat Library
Confirmed compromise campaigns across the marketplaces we track — affected extensions, malicious versions, and indicators of compromise. Search by hash, domain, campaign, store, or extension ID.
5 campaigns
62 affected
extensions
277 IOCs
133 samples
medium
Captain Products Ad Network
Long-clean Chrome extensions bought through developer-account handoffs, then updated to inject an ad banner beaconing to a throwaway Cloudflare Worker. Eight confirmed carriers (~560k installs); every banner funnels users to one clean 200k-install extension that is the network's real payout.
chrome
8 ext 8 IOCs 1 samples
critical
GlassWorm
First self-propagating worm using invisible-Unicode code; hit OpenVSX and the VS Code Marketplace, harvested NPM/GitHub/OpenVSX/Git credentials and 49 crypto wallets, and deployed the ZOMBI RAT.
openvsxvscode
14 ext 137 IOCs 132 samples
critical
Shai-Hulud
Self-replicating npm worm (Sept 2025, plus v2.0 Nov 2025 and Mini Shai-Hulud May 2026). Used TruffleHog to steal cloud/AI credentials; later waves explicitly targeted Claude Code / MCP config files.
mcpnpm
3 ext 129 IOCs
high
RedDirection
Legitimate, long-clean Chrome and Edge extensions turned malicious via routine auto-updates. Koi found 18 (~2.3M users); Spin.AI expanded the same campaign to 36 extensions and ~16.5M users.
chromeedge
36 ext 1 IOCs
high
Cyberhaven / GraphQL Network Inspector
OAuth-phishing of extension developers led to malicious updates. GraphQL Network Inspector v2.22.6 injected credential/session-stealing JS. The only Chrome-extension incident with published file hashes.
chrome
1 ext 2 IOCs
Campaign:
Store: Severity:
Affected extensions
62 of 62| Extension | Store | Malicious version | Installs | Campaign | Archived |
|---|---|---|---|---|---|
| Dark Mode Google Docs View analysis iabnclnclchijjckhdljmocghgmgnnii | chrome | 4.9.68 | 500K | CaptainProducts | yes |
| Chatgpt PDF | Ask your pdf View analysis ehfkleckcppfceemdamfiohancgjglhk | chrome | 1.4.2, 1.4.6 | 10K | CaptainProducts | no |
| VPN for Discord View analysis cpmminfjchfmlnoncniejplodncncoon | chrome | 0.0.4, 0.0.8 | 10K | CaptainProducts | no |
| Spell Check View analysis fclhkdjekjcalnjjkoohgcgbgpihlahf | chrome | 1.0.1 | 10K | CaptainProducts | no |
| HEIC to JPG Converter View analysis fhhnbmkllifmckbpacekbajjhhonakci | chrome | 2.2, 2.6 | 10K | CaptainProducts | no |
| Image Converter View analysis gjhalfmdneljejledkcljfeaapgppbhl | chrome | 1.3, 1.6 | 9K | CaptainProducts | no |
| AI Grammar Checker View analysis mkdobhlbckbmhkclkoagfgbnholndbcl | chrome | 1.0.1 | 7K | CaptainProducts | no |
| Screen recorder View analysis aohfenpemkefcdchmonkodnkdnkejegd | chrome | 3.1.12 | 4K | CaptainProducts | no |
| codejoy-vscode-extension View analysis codejoy.codejoy-vscode-extension | openvsx | 1.8.3, 1.8.4 | — | GlassWorm | yes |
| vscode-theme-seti-folder View analysis l-igh-t.vscode-theme-seti-folder | openvsx | 1.2.3 | — | GlassWorm | yes |
| serenity-dsl-syntaxhighlight View analysis kleinesfilmroellchen.serenity-dsl-syntaxhighlight | openvsx | 0.3.2 | — | GlassWorm | yes |
| rust-doc-viewer View analysis JScearcy.rust-doc-viewer | openvsx | 4.2.1 | — | GlassWorm | yes |
| dark-theme-sm View analysis SIRILMP.dark-theme-sm | openvsx | 3.11.4 | — | GlassWorm | yes |
| git-worktree-menu View analysis CodeInKlingon.git-worktree-menu | openvsx | 1.0.9, 1.0.91 | — | GlassWorm | yes |
| better-nunjucks View analysis ginfuru.better-nunjucks | openvsx | 0.3.2 | — | GlassWorm | no |
| recoil View analysis ellacrity.recoil | openvsx | 0.7.4 | — | GlassWorm | yes |
| positron-plus-1-e View analysis grrrck.positron-plus-1-e | openvsx | 0.0.71 | — | GlassWorm | yes |
| color-picker-universal View analysis jeronimoekerdt.color-picker-universal | openvsx | 2.8.91 | — | GlassWorm | no |
| srcery-colors View analysis srcery-colors.srcery-colors | openvsx | 0.3.9 | — | GlassWorm | yes |
| shopify-liquid View analysis sissel.shopify-liquid | openvsx | 4.0.1 | — | GlassWorm | yes |
| forts-api-extention View analysis TretinV3.forts-api-extention | openvsx | 0.3.1 | — | GlassWorm | yes |
cline-ai-agent cline-ai-main.cline-ai-agent | vscode | 3.1.3 | — | GlassWorm | no |
mcp-knowledge-base mcp-knowledge-base | mcp | 0.0.2 | — | Shai-Hulud | no |
@ctrl/tinycolor @ctrl/tinycolor | npm | 4.1.1 | — | Shai-Hulud | no |
rxnt-authentication rxnt-authentication | npm | 0.0.3 | — | Shai-Hulud | no |
| 2048 Game View analysis iabflonngmpkalkpbjonemaamlgdghea | chrome | — | 1M | RedDirection | no |
| Adblock Unlimited - Adblocker View analysis jiaopkfkampgnnkckajcbdgannoipcne | chrome | — | 90K | RedDirection | no |
| Image Downloader - Save pictures View analysis daeljdgmllhgmbdkpgnaojldjkdgkbjg | chrome | — | 200K | RedDirection | yes |
| Web Music Downloader View analysis dmbjkidogjmmlejdmnecpmfapdmidfjg | chrome | — | 500K | RedDirection | no |
| Super Mario Bros Game View analysis pegfdldddiilihjahcpdehhhfcbibipg | chrome | — | 200K | RedDirection | no |
| Video downloader - download any video View analysis kfpgookelklhphhnihipmknjdgbeecgj | chrome | — | 1M | RedDirection | no |
| Screen Capture View analysis pmnphobdokkajkpbkajlaiooipfcpgio | chrome | — | 700K | RedDirection | no |
| Dictionary all over with Synonyms View analysis ahjhlnckcgnoikkfkfnkbfengklhglpg | chrome | — | 400K | RedDirection | no |
| Multi Chat - Messenger for WhatsApp View analysis dllplfhjknghhdneiblmkolbjappecbe | chrome | — | 2M | RedDirection | yes |
| Video Downloader Online View analysis jglemppahimembneahjbkhjknnefeeio | chrome | — | 700K | RedDirection | no |
| PiP (Picture in picture) View analysis nalkmonnmldhpfcpdlbdpljlaajlaphh | chrome | — | 800K | RedDirection | yes |
| Mute Tab - Silent in a click View analysis inhefjomnpfkkegfklclbjhkifmpkkmn | chrome | — | 30K | RedDirection | no |
| Dark Mode for Chrome View analysis jhhjdfldilccfllhlbjdlhknlfbhpgeg | chrome | — | 4M | RedDirection | no |
| Good Video Downloader View analysis mhpcabliilgadobjpkameggapnpeppdg | chrome | — | 400K | RedDirection | no |
| Flash Player Enabler View analysis eplfglplnlljjpeiccbgnijecmkeimed | chrome | — | 300K | RedDirection | no |
| Auto HD & Additions for Youtube View analysis lagdcjmbchphhndlbpfajelapcodekll | chrome | — | 800K | RedDirection | no |
| What Font - find font View analysis acpcapnaopbhbelhmbbmppghilclpkep | chrome | — | 1M | RedDirection | no |
| Floating Video with Playback Controls View analysis pnanegnllonoiklmmlegcaajoicfifcm | chrome | — | 80K | RedDirection | yes |
| Emoji keyboard online View analysis kgmeffmlnkfnjpgmdndccklfigfhajen | chrome | — | — | RedDirection | no |
| Free Weather Forecast View analysis dpdibkjjgbaadnnjhkmmnenkmbnhpobj | chrome | — | — | RedDirection | no |
| Video Speed Controller - Video manager View analysis gaiceihehajjahakcglkhmdbbdclbnlf | chrome | — | — | RedDirection | no |
| Unlock Discord - VPN Proxy View analysis mlgbkfnjdmaoldgagamcnommbbnhfnhf | chrome | — | — | RedDirection | no |
| Dark Theme - Dark Reader for Chrome View analysis eckokfcjbjbgjifpcbdmengnabecdakp | chrome | — | — | RedDirection | no |
| Volume Max - Ultimate Sound Booster View analysis mgbhdehiapbjamfgekfpebmhmnmcmemg | chrome | — | — | RedDirection | no |
| Unblock TikTok View analysis cbajickflblmpjodnjoldpiicfmecmif | chrome | — | — | RedDirection | no |
| Unlock YouTube VPN View analysis pdbfcnhlobhoahcamoefbfodpmklgmjm | chrome | — | — | RedDirection | no |
| Color Picker, Eyedropper - Geco View analysis eokjikchkppnkdipbiggnmlkahcdkikp | chrome | — | — | RedDirection | no |
Weather ihbiedpeaicgipncdnnkikeehnjiddck | chrome | — | — | RedDirection | no |
Unlock TikTok jjdajogomggcjifnjgkpghcijgkbcjdi | edge | — | — | RedDirection | no |
Volume Booster - Increase your sound mmcnmppeeghenglmidpmjkaiamcacmgm | edge | — | — | RedDirection | no |
Web Sound Equalizer ojdkklpgpacpicaobnhankbalkkgaafp | edge | — | — | RedDirection | no |
Header Value lodeighbngipjjedfelnboplhgediclp | edge | — | — | RedDirection | no |
Flash Player - games emulator hkjagicdaogfgdifaklcgajmgefjllmd | edge | — | — | RedDirection | no |
Youtube Unblocked gflkbgebojohihfnnplhbdakoipdbpdm | edge | — | — | RedDirection | no |
SearchGPT - ChatGPT for Search Engine kpilmncnoafddjpnbhepaiilgkdcieaf | edge | — | — | RedDirection | no |
Unlock Discord caibdnkmpnjhjdfnomfhijhmebigcelo | edge | — | — | RedDirection | no |
GraphQL Network Inspector unknown-graphql-network-inspector | chrome | 2.22.6 | — | Cyberhaven | no |