Malicious VS Code Tasks Target Open-Source Maintainers

Summary

Researchers report 21 open-source contributors’ repositories compromised with VS Code tasks that run downloaded scripts on folder open. The payloads are currently described as innocuous; the actor is unknown.

Key points

OpenSourceMalware says it identified 21 compromised contributors’ repositories over 72 hours; it contacted affected users.
Malicious .vscode/tasks.json files are configured to run tasks when a project folder opens in VS Code, downloading platform-specific scripts.
One victim reportedly said the task file was added without their knowledge and suspected a compromised GitHub personal access token; another found stolen SSH keys had been used to access GitHub.
Researchers say the scripts observed so far appear innocuous, but could be changed to deliver malicious payloads.
The actor is unknown. Researchers note similarities to DPRK campaign tactics but say they are still investigating possible links to Shai-Hulud and S1ngularity.
The report warns stolen development credentials could enable supply-chain attacks on projects maintainers contribute to.
Recommended precautions include disabling automatic tasks, reviewing .vscode directories and unexpected task-file changes, and checking for the reported infrastructure: vscode-extension-260120[.]vercel[.]app.

Article Details

Event Type: Ongoing campaign compromising open-source maintainers’ repositories by planting malicious VS Code task configurations that download and execute scripts.
Impact: The article reports 21 contributors had repositories compromised in 72 hours. In at least one case, a victim said a GitHub personal access token may have been compromised; another reported stolen SSH keys were used to authenticate to GitHub and upload the task file. The observed payloads were described as currently innocuous placeholders, but the attacker could replace them with malicious payloads, potentially enabling credential and cryptocurrency theft or persistence. Attribution is unknown; the article says the activity resembles DPRK tactics.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`vscode-extension-260120[.]vercel[.]app`	Host identified by the article as C2 infrastructure for delivering the campaign’s payloads.
URL	`hxxps[:]//vscode-extension-260120[.]vercel[.]app/settings/linux?flag=5-`	URL identified by the article as C2 infrastructure; the task configuration uses it to download a shell script.
URL	`hxxps[:]//vscode-extension-260120[.]vercel[.]app/settings/win?flag=5-`	URL identified by the article as C2 infrastructure for the Windows-specific payload.