Researchers Detail Malware Hidden in VS Code Dictionary Files
Summary
OpenSourceMalware describes a Contagious Interview campaign variant using VS Code tasks and an obfuscated dictionary file to install a persistent Node.js backdoor that retrieves code from ip-regions-check[.]vercel[.]app.
Key points
- The report says a repository’s .vscode/tasks.json can trigger the initial infection when opened in VS Code; a disguised .vscode/spellright.dict file provides a backup delivery method.
- The purported dictionary file contains obfuscated JavaScript rather than a normal word list.
- The dropper writes a second-stage Node.js payload to ~/Programs_X64/main.js and installs packages including axios, request, and sqlite3.
- The payload contacts ip-regions-check[.]vercel[.]app and evaluates the server’s response as JavaScript, enabling remote code execution.
- The report describes hidden, persistent execution on Windows, Linux, and macOS.
- OpenSourceMalware attributes the campaign to North Korean actors associated with Lazarus Group; the article does not provide independent confirmation of that attribution.
Article Details
- Attack Vectors
- A malicious repository includes a VS Code tasks.json file that runs when the folder is opened, delivering the initial payload.
- The repository also contains heavily obfuscated JavaScript disguised as a SpellRight dictionary in .vscode/spellright.dict as a backup delivery method.
- The campaign reportedly approaches developers with fake job offers or crypto-project coding assessments and sends malicious coding challenges or NPM packages.
- Defensive Notes
- Treat unusually large .vscode/spellright.dict files containing JavaScript as suspicious; legitimate custom dictionary files are normally plain text word lists.
- Inspect repository .vscode/tasks.json files before opening a project in VS Code, especially for tasks configured to run on folderOpen.
- Review unexpected hidden processes and files under ~/Programs_X64/, and investigate unexpected installations of axios, request, and sqlite3 in this context.
- The article warns that the malicious task may run again when VS Code opens the directory; the dropper also reportedly establishes a background Node.js process.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ip-regions-check[.]vercel[.]app | C2 domain used by the malware to retrieve JavaScript payloads. |
| IPV4 | 146[.]70[.]41[.]188 | Listed by the article as an indicator of compromise for the campaign. |
| URL | hxxps[:]//ip-regions-check[.]vercel[.]app/api/ip-check-encrypted/3aeb34a38 | Specific C2 payload endpoint identified in the article; the malware POSTs to it and executes the response. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript payload is heavily obfuscated using hidden strings, hex offsets, runtime shuffling, and, in the later stage, encrypted strings.T1053.005 · Scheduled TaskThe repository's VS Code tasks.json reportedly uses the folderOpen event to run the initial payload when the project folder is opened.T1059.001 · PowerShellThe Windows execution command uses PowerShell Start-Process to install packages and launch the payload.T1059.004 · Unix ShellThe Unix/Linux/macOS command uses bash to initialize npm, install packages, and launch the payload.T1059.007 · JavaScriptThe initial payload and subsequent stages use JavaScript, including eval(response.data), to execute code.T1071.001 · Web ProtocolsThe malware communicates with its C2 over HTTPS using an HTTP POST request.T1105 · Ingress Tool TransferThe dropper retrieves a second-stage JavaScript payload from the C2 endpoint.T1140 · Deobfuscate/Decode Files or InformationThe article describes runtime string decryption using RC4 and Base64 decoding in the later-stage payload.T1497.001 · System ChecksThe later-stage payload reportedly uses RegExp-based debugger detection to alter behavior.T1547.013 · XDG Autostart EntriesThe article describes a VS Code folder-open task that reruns the payload when the directory is opened in VS Code.T1564.003 · Hidden WindowThe payload creates a directory named Programs_X64 in the user's home directory and launches a hidden Windows process.
Threat Actors
Products
SpellRightInterview" campaign. The malware disguises itself as a harmless spell-check dictionary (.vscode/spellright.dict) but contains heavily obfuscated JavaScript that establishes a persistent backdoor with fullVSCodeis embedded in a file in the source repository. Both of these latest campaigns take advantage of Microsoft VSCode tasks functionality to automatically infect developers that open the source code in VSCode. A
Tools
Countries
Industries
Blockchainof technical expertise and access to valuable financial assets. Engineers working in cryptocurrency, blockchain, and fintech sectors often have privileged access to digital wallets, private keys, exchangeCryptocurrencyintersection of technical expertise and access to valuable financial assets. Engineers working in cryptocurrency, blockchain, and fintech sectors often have privileged access to digital wallets, private keys,fintechexpertise and access to valuable financial assets. Engineers working in cryptocurrency, blockchain, and fintech sectors often have privileged access to digital wallets, private keys, exchange infrastructure, andTechnologytargets for theft operations that directly fund the DPRK regime. Additionally, compromised engineers at technology companies, startups, and financial institutions can provide access to proprietary source code,