MAL-2025-191158
See a problem?- Import Source
- https://github.com/ossf/malicious-packages/blob/main/osv/malicious/vscode:open-vsx.org/codeinklingon.git-worktree-menu/MAL-2025-191158.json
- JSON Data
- https://api.osv.dev/v1/vulns/MAL-2025-191158
- Published
- 2025-11-19T05:55:49Z
- Modified
- 2025-11-26T00:07:20.982515Z
- Summary
- Malicious code in CodeInKlingon.git-worktree-menu (VSCode:https://open-vsx.org)
- Details
-
-= Per source details. Do not edit below this line.=-
Source: google-open-source-security (68ef1fadb311fcf38b0a3d9f7e7845c12f201bfdab9556387e9a8b052cec8ee5)
This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency wallets. The extension also provides remote access and attempts to propagate itself.
- Database specific
{ "malicious-packages-origins": [ { "sha256": "68ef1fadb311fcf38b0a3d9f7e7845c12f201bfdab9556387e9a8b052cec8ee5", "source": "google-open-source-security", "modified_time": "2025-11-19T05:55:49Z", "versions": [ "1.0.9", "1.0.91" ], "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "import_time": "2025-11-19T05:56:22.73567Z" } ], "iocs": { "ips": [ "217.69.3.218", "199.247.10.166" ], "urls": [ "http://140.82.52.31:80/wall", "http://199.247.13.106:80/wall", "https://calendar.app.google/M2ZCvM8ULL56PD1d6", "http://217.69.3.218/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D", "http://217.69.3.218/get_arhive_npm/", "http://217.69.3.218/get_zombi_payload/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D" ] } }- References