MAL-2025-191167
See a problem?- Import Source
- https://github.com/ossf/malicious-packages/blob/main/osv/malicious/vscode:open-vsx.org/sirilmp.dark-theme-sm/MAL-2025-191167.json
- JSON Data
- https://api.osv.dev/v1/vulns/MAL-2025-191167
- Published
- 2025-11-19T05:55:49Z
- Modified
- 2025-11-26T00:13:27.715545Z
- Summary
- Malicious code in SIRILMP.dark-theme-sm (VSCode:https://open-vsx.org)
- Details
-
-= Per source details. Do not edit below this line.=-
Source: google-open-source-security (a30acc5c978ef579bc01603521f705b16016df5a2e72e44e1c0f3222ff2e6068)
This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency wallets. The extension also provides remote access and attempts to propagate itself.
- Database specific
{ "iocs": { "urls": [ "http://140.82.52.31:80/wall", "http://199.247.13.106:80/wall", "https://calendar.app.google/M2ZCvM8ULL56PD1d6", "http://217.69.3.218/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D", "http://217.69.3.218/get_arhive_npm/", "http://217.69.3.218/get_zombi_payload/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D" ], "ips": [ "217.69.3.218", "199.247.10.166" ] }, "malicious-packages-origins": [ { "import_time": "2025-11-19T05:56:22.731297Z", "modified_time": "2025-11-19T05:55:49Z", "source": "google-open-source-security", "sha256": "a30acc5c978ef579bc01603521f705b16016df5a2e72e44e1c0f3222ff2e6068", "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" } ] } ], "versions": [ "3.11.4" ] } ] }- References