Back Gbhackers

Open VSX Extension Delivers RAT and Stealer via GitHub Downloader

Gbhackers •Mayura Kathir • March 19, 2026

An Open VSX extension used by thousands of developers has been caught silently pulling a full-featured remote access trojan and infostealer from GitHub. The KhangNghiem/fast-draft extension, listed on open-vsx.org and tracked at over 26,000 downloads as of March 17, 2026, contained multiple malicious releases that executed a GitHub-hosted downloader and fetched a second-stage payload from […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious fast-draft Open VSX Extension Distributes RAT and Infostealer The KhangNghiem/fast-draft extension on Open VSX was found to contain multiple malicious releases that deploy a remote access trojan (RAT) and an infostealer. Versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112 were confirmed to be compromised, while versions 0.10.88 and 0.10.111 were clean. The malicious versions utilize a GitHub-hosted downloader to fetch and execute payloads, indicating a potential compromise of the publisher or a stolen token rather than intentional malicious behavior by the maintainer. The extension has over 26,000 downloads, raising concerns about the scope of potential impact on developers. The latest clean version, 0.10.135, was released on 2026-03-17 and does not exhibit the same malicious behavior. The issue was reported to the maintainer on 2026-03-12, but the GitHub issue remains open as of the latest article date. 3 sources 71

Extracted Entities

Open VSX Extension Delivers RAT and Stealer via GitHub Downloader

The full story

Extracted Entities

Attack Types (2)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)