Threat Library
Confirmed compromise campaigns across the marketplaces we track — affected extensions, malicious versions, and indicators of compromise. Search by hash, domain, campaign, store, or extension ID.
6 campaigns
107 affected
extensions
282 IOCs
133 samples
high
Count Dooku
Supply-chain campaign that re-published legitimate VS Code extensions to Open VSX with a malicious JavaScript IIFE appended after the source-map comment — placed outside the source map so casual review and diff tools miss it. The injected payload beacons to a hard-coded C2. Tracked by opensourcemalware.com.
openvsx
45 ext 5 IOCs
medium
Captain Products Ad Network
Long-clean Chrome extensions bought through developer-account handoffs, then updated to inject an ad banner beaconing to a throwaway Cloudflare Worker. Eight confirmed carriers (~560k installs); every banner funnels users to one clean 200k-install extension that is the network's real payout.
chrome
8 ext 8 IOCs 1 samples
critical
GlassWorm
First self-propagating worm using invisible-Unicode code; hit OpenVSX and the VS Code Marketplace, harvested NPM/GitHub/OpenVSX/Git credentials and 49 crypto wallets, and deployed the ZOMBI RAT.
openvsxvscode
14 ext 137 IOCs 132 samples
critical
Shai-Hulud
Self-replicating npm worm (Sept 2025, plus v2.0 Nov 2025 and Mini Shai-Hulud May 2026). Used TruffleHog to steal cloud/AI credentials; later waves explicitly targeted Claude Code / MCP config files.
mcpnpm
3 ext 129 IOCs
high
RedDirection
Legitimate, long-clean Chrome and Edge extensions turned malicious via routine auto-updates. Koi found 18 (~2.3M users); Spin.AI expanded the same campaign to 36 extensions and ~16.5M users.
chromeedge
36 ext 1 IOCs
high
Cyberhaven / GraphQL Network Inspector
OAuth-phishing of extension developers led to malicious updates. GraphQL Network Inspector v2.22.6 injected credential/session-stealing JS. The only Chrome-extension incident with published file hashes.
chrome
1 ext 2 IOCs
Campaign:
Store: Severity:
Affected extensions
107 of 107| Extension | Store | Malicious version | Installs | Campaign | Archived |
|---|---|---|---|---|---|
| pokemon-pets View analysis Anasfiguigui.pokemon-pets | openvsx | 1.3.0 | — | Count Dooku | no |
| codebuddy-ai View analysis CodebuddyAI.codebuddy-ai | openvsx | 1.7.0 | — | Count Dooku | no |
| dadroit-json-generator View analysis Dadroit.dadroit-json-generator | openvsx | 1.2.2 | — | Count Dooku | no |
| csv-excel-viewer View analysis Development42.csv-excel-viewer | openvsx | 1.9.0 | — | Count Dooku | no |
| competitive-programming-helper View analysis DivyanshuAgrawal.competitive-programming-helper | openvsx | 2026.6.1780853884 | — | Count Dooku | no |
| doubao-app-share-vscode-plugin View analysis Doubao.doubao-app-share-vscode-plugin | openvsx | 0.1.2 | — | Count Dooku | no |
| html-preview-pro View analysis GingerTurtle.html-preview-pro | openvsx | 1.1.0 | — | Count Dooku | no |
| kimi-vscode View analysis Kingleo.kimi-vscode | openvsx | 0.0.6 | — | Count Dooku | no |
| claude-color-theme View analysis Lumidew.claude-color-theme | openvsx | 0.0.6 | — | Count Dooku | no |
| vscode-paste-and-indent View analysis Rubymaniac.vscode-paste-and-indent | openvsx | 0.0.8 | — | Count Dooku | no |
| docxreader View analysis ShahilKumar.docxreader | openvsx | 1.4.2 | — | Count Dooku | no |
| Document-Viewer-VSCode-Extensions View analysis SyncfusionInc.Document-Viewer-VSCode-Extensions | openvsx | 4.0.4 | — | Count Dooku | no |
| open-excel View analysis TomRileyTech.open-excel | openvsx | 0.0.1 | — | Count Dooku | no |
| vscode-1c-metadata-viewer View analysis Zerobig.vscode-1c-metadata-viewer | openvsx | 0.2.3 | — | Count Dooku | no |
| gemini-cli-launcher View analysis acebunny00.gemini-cli-launcher | openvsx | 0.1.0 | — | Count Dooku | no |
| node-essentials View analysis afractal.node-essentials | openvsx | 1.1.0 | — | Count Dooku | no |
| a-file-icon-vscode View analysis atommaterial.a-file-icon-vscode | openvsx | 2.0.1 | — | Count Dooku | no |
| markitdown-vscode View analysis bioinfo.markitdown-vscode | openvsx | 0.3.1 | — | Count Dooku | no |
| vscode-ripgrep View analysis bokuweb.vscode-ripgrep | openvsx | 0.2.2 | — | Count Dooku | no |
| vscode-deepseek View analysis colourafredi.vscode-deepseek | openvsx | 1.6.2 | — | Count Dooku | no |
| pptx-preview View analysis corotata.pptx-preview | openvsx | 1.0.1 | — | Count Dooku | no |
| sql-server-profiler-tool View analysis epolicardo.sql-server-profiler-tool | openvsx | 0.5.1 | — | Count Dooku | no |
| vscode-fabric View analysis fabric.vscode-fabric | openvsx | 0.39.18 | — | Count Dooku | no |
| hostinger-connector View analysis hostinger-official.hostinger-connector | openvsx | 1.2.3 | — | Count Dooku | no |
| web-viewer View analysis hss.web-viewer | openvsx | 0.0.2 | — | Count Dooku | no |
| node-runner View analysis huanent.node-runner | openvsx | 1.0.2 | — | Count Dooku | no |
| claude-commit View analysis juajnnlb.claude-commit | openvsx | 1.0.4 | — | Count Dooku | no |
| claude-commit View analysis juanlb.claude-commit | openvsx | 1.0.1 | — | Count Dooku | no |
| plan-uml View analysis justuskarlsson.plan-uml | openvsx | 0.0.8 | — | Count Dooku | no |
| protobuf View analysis kangping.protobuf | openvsx | 1.1.6 | — | Count Dooku | no |
| vscode-openrouter-extension View analysis khaled.vscode-openrouter-extension | openvsx | 0.5.0 | — | Count Dooku | no |
| yaml-with-script View analysis matthiesen-technology.yaml-with-script | openvsx | 1.1.3 | — | Count Dooku | no |
| Lisp View analysis mattn.Lisp | openvsx | 0.1.12 | — | Count Dooku | no |
| streamlit-preview View analysis mjethwa-streamlit.streamlit-preview | openvsx | 3.3.4 | — | Count Dooku | no |
| csv-to-table View analysis phplasma.csv-to-table | openvsx | 1.4.1 | — | Count Dooku | no |
| vscode-playwright-test-runner View analysis sakamoto66.vscode-playwright-test-runner | openvsx | 1.4.1 | — | Count Dooku | no |
| json-server View analysis sarthikbhat.json-server | openvsx | 0.0.4 | — | Count Dooku | no |
| md-editor View analysis seepine.md-editor | openvsx | 0.1.1 | — | Count Dooku | no |
| bazel-vscode View analysis sfdc-eng.bazel-vscode | openvsx | 0.26.106021821 | — | Count Dooku | no |
| office-editor View analysis shubhamprajapati1202.office-editor | openvsx | 1.0.1 | — | Count Dooku | no |
| markdown-pdf-plus View analysis tom-latham.markdown-pdf-plus | openvsx | 1.1.0 | — | Count Dooku | no |
| cursor-ai View analysis vbrocket.cursor-ai | openvsx | 0.2.0 | — | Count Dooku | no |
| vscode-ollama View analysis warm3snow.vscode-ollama | openvsx | 1.2.1 | — | Count Dooku | no |
| obsidian-md-vsc View analysis willasm.obsidian-md-vsc | openvsx | 1.3.0 | — | Count Dooku | no |
| luahelper View analysis yinfei.luahelper | openvsx | 0.2.29 | — | Count Dooku | no |
| Dark Mode Google Docs View analysis iabnclnclchijjckhdljmocghgmgnnii | chrome | 4.9.68 | 500K | CaptainProducts | yes |
| Chatgpt PDF | Ask your pdf View analysis ehfkleckcppfceemdamfiohancgjglhk | chrome | 1.4.2, 1.4.6 | 10K | CaptainProducts | no |
| VPN for Discord View analysis cpmminfjchfmlnoncniejplodncncoon | chrome | 0.0.4, 0.0.8 | 10K | CaptainProducts | no |
| Spell Check View analysis fclhkdjekjcalnjjkoohgcgbgpihlahf | chrome | 1.0.1 | 10K | CaptainProducts | no |
| HEIC to JPG Converter View analysis fhhnbmkllifmckbpacekbajjhhonakci | chrome | 2.2, 2.6 | 10K | CaptainProducts | no |
| Image Converter View analysis gjhalfmdneljejledkcljfeaapgppbhl | chrome | 1.3, 1.6 | 9K | CaptainProducts | no |
| AI Grammar Checker View analysis mkdobhlbckbmhkclkoagfgbnholndbcl | chrome | 1.0.1 | 7K | CaptainProducts | no |
| Screen recorder View analysis aohfenpemkefcdchmonkodnkdnkejegd | chrome | 3.1.12 | 4K | CaptainProducts | no |
| codejoy-vscode-extension View analysis codejoy.codejoy-vscode-extension | openvsx | 1.8.3, 1.8.4 | — | GlassWorm | yes |
| vscode-theme-seti-folder View analysis l-igh-t.vscode-theme-seti-folder | openvsx | 1.2.3 | — | GlassWorm | yes |
| serenity-dsl-syntaxhighlight View analysis kleinesfilmroellchen.serenity-dsl-syntaxhighlight | openvsx | 0.3.2 | — | GlassWorm | yes |
| rust-doc-viewer View analysis JScearcy.rust-doc-viewer | openvsx | 4.2.1 | — | GlassWorm | yes |
| dark-theme-sm View analysis SIRILMP.dark-theme-sm | openvsx | 3.11.4 | — | GlassWorm | yes |
| git-worktree-menu View analysis CodeInKlingon.git-worktree-menu | openvsx | 1.0.9, 1.0.91 | — | GlassWorm | yes |
| better-nunjucks View analysis ginfuru.better-nunjucks | openvsx | 0.3.2 | — | GlassWorm | no |
| recoil View analysis ellacrity.recoil | openvsx | 0.7.4 | — | GlassWorm | yes |
| positron-plus-1-e View analysis grrrck.positron-plus-1-e | openvsx | 0.0.71 | — | GlassWorm | yes |
| color-picker-universal View analysis jeronimoekerdt.color-picker-universal | openvsx | 2.8.91 | — | GlassWorm | no |
| srcery-colors View analysis srcery-colors.srcery-colors | openvsx | 0.3.9 | — | GlassWorm | yes |
| shopify-liquid View analysis sissel.shopify-liquid | openvsx | 4.0.1 | — | GlassWorm | yes |
| forts-api-extention View analysis TretinV3.forts-api-extention | openvsx | 0.3.1 | — | GlassWorm | yes |
cline-ai-agent cline-ai-main.cline-ai-agent | vscode | 3.1.3 | — | GlassWorm | no |
mcp-knowledge-base mcp-knowledge-base | mcp | 0.0.2 | — | Shai-Hulud | no |
@ctrl/tinycolor @ctrl/tinycolor | npm | 4.1.1 | — | Shai-Hulud | no |
rxnt-authentication rxnt-authentication | npm | 0.0.3 | — | Shai-Hulud | no |
| 2048 Game View analysis iabflonngmpkalkpbjonemaamlgdghea | chrome | — | 1M | RedDirection | no |
| Adblock Unlimited - Adblocker View analysis jiaopkfkampgnnkckajcbdgannoipcne | chrome | — | 90K | RedDirection | no |
| Image Downloader - Save pictures View analysis daeljdgmllhgmbdkpgnaojldjkdgkbjg | chrome | — | 200K | RedDirection | yes |
| Web Music Downloader View analysis dmbjkidogjmmlejdmnecpmfapdmidfjg | chrome | — | 500K | RedDirection | no |
| Super Mario Bros Game View analysis pegfdldddiilihjahcpdehhhfcbibipg | chrome | — | 200K | RedDirection | no |
| Video downloader - download any video View analysis kfpgookelklhphhnihipmknjdgbeecgj | chrome | — | 1M | RedDirection | no |
| Screen Capture View analysis pmnphobdokkajkpbkajlaiooipfcpgio | chrome | — | 700K | RedDirection | no |
| Dictionary all over with Synonyms View analysis ahjhlnckcgnoikkfkfnkbfengklhglpg | chrome | — | 400K | RedDirection | no |
| Multi Chat - Messenger for WhatsApp View analysis dllplfhjknghhdneiblmkolbjappecbe | chrome | — | 2M | RedDirection | yes |
| Video Downloader Online View analysis jglemppahimembneahjbkhjknnefeeio | chrome | — | 700K | RedDirection | no |
| PiP (Picture in picture) View analysis nalkmonnmldhpfcpdlbdpljlaajlaphh | chrome | — | 800K | RedDirection | yes |
| Mute Tab - Silent in a click View analysis inhefjomnpfkkegfklclbjhkifmpkkmn | chrome | — | 30K | RedDirection | no |
| Dark Mode for Chrome View analysis jhhjdfldilccfllhlbjdlhknlfbhpgeg | chrome | — | 4M | RedDirection | no |
| Good Video Downloader View analysis mhpcabliilgadobjpkameggapnpeppdg | chrome | — | 400K | RedDirection | no |
| Flash Player Enabler View analysis eplfglplnlljjpeiccbgnijecmkeimed | chrome | — | 300K | RedDirection | no |
| Auto HD & Additions for Youtube View analysis lagdcjmbchphhndlbpfajelapcodekll | chrome | — | 800K | RedDirection | no |
| What Font - find font View analysis acpcapnaopbhbelhmbbmppghilclpkep | chrome | — | 1M | RedDirection | no |
| Floating Video with Playback Controls View analysis pnanegnllonoiklmmlegcaajoicfifcm | chrome | — | 80K | RedDirection | yes |
| Emoji keyboard online View analysis kgmeffmlnkfnjpgmdndccklfigfhajen | chrome | — | — | RedDirection | no |
| Free Weather Forecast View analysis dpdibkjjgbaadnnjhkmmnenkmbnhpobj | chrome | — | — | RedDirection | no |
| Video Speed Controller - Video manager View analysis gaiceihehajjahakcglkhmdbbdclbnlf | chrome | — | — | RedDirection | no |
| Unlock Discord - VPN Proxy View analysis mlgbkfnjdmaoldgagamcnommbbnhfnhf | chrome | — | — | RedDirection | no |
| Dark Theme - Dark Reader for Chrome View analysis eckokfcjbjbgjifpcbdmengnabecdakp | chrome | — | — | RedDirection | no |
| Volume Max - Ultimate Sound Booster View analysis mgbhdehiapbjamfgekfpebmhmnmcmemg | chrome | — | — | RedDirection | no |
| Unblock TikTok View analysis cbajickflblmpjodnjoldpiicfmecmif | chrome | — | — | RedDirection | no |
| Unlock YouTube VPN View analysis pdbfcnhlobhoahcamoefbfodpmklgmjm | chrome | — | — | RedDirection | no |
| Color Picker, Eyedropper - Geco View analysis eokjikchkppnkdipbiggnmlkahcdkikp | chrome | — | — | RedDirection | no |
Weather ihbiedpeaicgipncdnnkikeehnjiddck | chrome | — | — | RedDirection | no |
Unlock TikTok jjdajogomggcjifnjgkpghcijgkbcjdi | edge | — | — | RedDirection | no |
Volume Booster - Increase your sound mmcnmppeeghenglmidpmjkaiamcacmgm | edge | — | — | RedDirection | no |
Web Sound Equalizer ojdkklpgpacpicaobnhankbalkkgaafp | edge | — | — | RedDirection | no |
Header Value lodeighbngipjjedfelnboplhgediclp | edge | — | — | RedDirection | no |
Flash Player - games emulator hkjagicdaogfgdifaklcgajmgefjllmd | edge | — | — | RedDirection | no |
Youtube Unblocked gflkbgebojohihfnnplhbdakoipdbpdm | edge | — | — | RedDirection | no |
SearchGPT - ChatGPT for Search Engine kpilmncnoafddjpnbhepaiilgkdcieaf | edge | — | — | RedDirection | no |
Unlock Discord caibdnkmpnjhjdfnomfhijhmebigcelo | edge | — | — | RedDirection | no |
GraphQL Network Inspector unknown-graphql-network-inspector | chrome | 2.22.6 | — | Cyberhaven | no |