BleepingComputer reports that the widely used Solidity VSCode extension has been spoofed in the open-source Open VSX registry to distribute the new SleepyDuck remote access trojan to unsuspecting developers.
Secure Annex researchers discovered that the fake Solidity extension, which has amassed over 53,000 downloads so far, had been embedded with malicious code only a day after it was uploaded on Oct. 31. Initial activation of the fraudulent Solidity extension prompts lock file creation and bogus 'webpack.init()' function retrieval to covertly load the SleepyDuck RAT, which leverages Ethereum contracts for command-and-control server updates and long-term persistence.
Apart from obtaining system data, including hostnames, usernames, timezones, and MAC addresses, SleepyDuck RAT also establishes a command execution sandbox, with the Ethereum blockchain harnessed by the malware to ensure continued receipt of instructions even in the event of an offline primary command server.
Mounting cybersecurity threats against Open VSX have prompted the platform to accelerate leaked credential revocations, enforce automated scans, and implement other security improvements.
