Rogue Prettier Extension is a tool tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed November 25, 2025; most recent activity November 25, 2025.
Rogue Prettier Extension is a malicious VSCode extension masquerading as the legitimate Prettier code formatter. When installed from the VSCode Marketplace, it delivers the Anivia Stealer payload to the host, enabling data exfiltration via the IDE environment. This incident highlights the growing risk of supply-chain and extension-based compromises in developer tooling.
A malicious extension named 'prettier-vscode-plus' was removed from the VSCode Marketplace after being identified as a Brandjacking attempt. This extension was designed to deploy Anivia Stealer malware, targeting…