Back Cybersecuritynews

Backdoored Open VSX Extension Used GitHub Downloader to Deploy RAT and Stealer

Cybersecuritynews •Tushar Subhra Dutta • March 19, 2026

A popular code editor extension listed on the Open VSX registry was discovered carrying hidden malware that silently fetches and runs a remote access trojan (RAT) and a full infostealer directly onto developer machines without any visible warning sign. The extension, known as fast-draft under the KhangNghiem publisher account, had accumulated over 26,000 downloads before the malicious activity embedded […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious fast-draft Open VSX Extension Distributes RAT and Infostealer The KhangNghiem/fast-draft extension on Open VSX was found to contain multiple malicious releases that deploy a remote access trojan (RAT) and an infostealer. Versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112 were confirmed to be compromised, while versions 0.10.88 and 0.10.111 were clean. The malicious versions utilize a GitHub-hosted downloader to fetch and execute payloads, indicating a potential compromise of the publisher or a stolen token rather than intentional malicious behavior by the maintainer. The extension has over 26,000 downloads, raising concerns about the scope of potential impact on developers. The latest clean version, 0.10.135, was released on 2026-03-17 and does not exhibit the same malicious behavior. The issue was reported to the maintainer on 2026-03-12, but the GitHub issue remains open as of the latest article date. 3 sources 71

Extracted Entities

Backdoored Open VSX Extension Used GitHub Downloader to Deploy RAT and Stealer

The full story

Extracted Entities

Attack Types (2)

Companies (1)

MITRE ATT&CK (2)

Platforms (1)