Hackers Weaponized Open VSX Extension with Sophisticated Malware After Reaching 5066 Downloads

Cybersecuritynews •Tushar Subhra Dutta • January 30, 2026

A dangerous malware campaign has infiltrated the Open VSX extension marketplace, compromising over 5,000 developer workstations through a fake Angular Language Service extension. The malicious package disguised itself as legitimate development tooling, bundling authentic Angular and TypeScript components alongside encrypted malware code that activates when developers open HTML or TypeScript files. The extension operated undetected […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Campaign Targets Open VSX Extension with 5,066 Downloads A sophisticated malware campaign has compromised the Open VSX extension marketplace, affecting over 5,000 developer workstations. The malicious package masqueraded as a legitimate Angular Language Service extension, embedding encrypted malware that activates upon opening HTML or TypeScript files. The attack utilized typosquatting and steganography techniques to evade detection. 20 sources 37

Hackers Weaponized Open VSX Extension with Sophisticated Malware After Reaching 5066 Downloads

The full story

Extracted Entities

Attack Types (1)

Companies (1)