Count Dooku

What happened

Count Dooku is a supply-chain campaign that takes legitimate, popular VS Code
extensions and re-publishes them to Open VSX under
throwaway publisher namespaces. The re-published package is byte-for-byte the
real extension with one change: a malicious JavaScript IIFE appended to the
bundled extension.js after the //# sourceMappingURL= comment.

Putting the payload after the source-map reference is the whole trick. The
legitimate code, its source map, and every line a reviewer would diff against
the upstream package all appear normal — the injected block sits past the point
where most people (and many automated diff tools) stop reading. On activation
the payload beacons to a hard-coded C2 (https://beststats.world/ping).

Because the carrier is a genuine, useful extension, static reputation and
"does it work?" checks pass cleanly — which is exactly why our own conservative
scorer initially rated many of these LOW. They were surfaced by
cross-referencing the opensourcemalware.com
community threat feed against our catalog.

Why it matters

Open VSX has no publisher-identity verification comparable to the Microsoft
Marketplace, so an attacker can stand up 25+ disposable namespaces and mirror
the most-installed extensions faster than takedowns land. Anyone whose editor
(Cursor, Windsurf, VSCodium, Gitpod, and other VS Code forks default to Open
VSX) resolves these names pulls the trojanized build.

How to spot it

The signature is structural, not string-based:

1. A bundled JS file (extension.js / dist/*.js) has executable code after
   its //# sourceMappingURL= trailer — a source map is supposed to be the
   last thing in the file.
2. That trailing block is a self-invoking function ((function(){…})() /
   (()=>{…})()) containing network egress (fetch/https.request/XMLHttpRequest)
   to a domain absent from the extension's declared functionality.
3. The package is a near-exact copy of a more-installed extension published
   under a different, low-reputation Open VSX namespace.

See the detection proposal filed with this campaign for the YARA rule and the
scoring change.