MAL-2026-16010

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/vscode/azurecdninfo.edrtester/MAL-2026-16010.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16010
Published
2026-09-03T00:00:00Z
Modified
2026-09-07T10:31:27Z
Summary
Malicious code in AzureCdnInfo.edrtester (VSCode)
Details

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester (version 1.0.4) presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and resolves the Windows domain controller / PDC via DNS SRV and reverse lookups (ext.dns.js: queryDC() / queryPDC()).

It then opens an outbound beacon, immediately on activation and every 150 seconds thereafter (setUpBeaconing() on a setInterval), via an http.request to xeroshoes.com:80 on path /bcon/ — but it sets the Host: header to officeupdate.southeast.cloudapp.azure-cdn.info and a decoy browser User-Agent. Because the TCP peer and the advertised host differ, this is HTTP Host-header domain fronting (not SNI). The beacon exfiltrates hostname, local IP and a timestamp under the decoy identity.

A reverse-shell function (phone_home()) and an AES-decrypt routine are bundled, but in this build the reverse shell is not dispatched (no command handler wires it up) and a second endpoint goofy.japaneast.cloudapp.azure.com is commented out, so the active scope is host reconnaissance plus beaconing. The dormant remote-command capability is a trivial change away from being armed. Analysis was static (code + dataflow) on the inert VSIX; no installation, execution, or live callback was performed.

Detected and classified independently by codelake Research from the VS Code Marketplace feed; at the time of reporting AzureCdnInfo.edrtester was not present in OSV or GHSA (a first-catch).

Database specific 
{
    "iocs": {
        "domains": [
            "xeroshoes.com",
            "officeupdate.southeast.cloudapp.azure-cdn.info"
        ],
        "files": [
            {
                "digests": {
                    "sha256": "eebb86f9d25df589229ce17cb2ee98c3b37f79739f4abb608171ed64977cbb77"
                },
                "note": "Core payload: host recon, 150s HTTP beacon with Host-header domain fronting, AES-decrypt routine, and a dormant reverse shell (phone_home, not dispatched in this build).",
                "paths": [
                    "extension/edrdrill.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "0615802ff0a30b46b159a064bd63ae7a58bab0097c215bce608f4c67306bfeaf"
                },
                "note": "VS Code activation entrypoint; loads the payload module on activate().",
                "paths": [
                    "extension/extension.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "acd8833a51e369f4d5638191322bd14196d6960dd70b3b5142d91d8daf92cec5"
                },
                "note": "Active Directory reconnaissance: domain controller / PDC discovery via DNS SRV and reverse lookups (queryDC/queryPDC).",
                "paths": [
                    "extension/ext.dns.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "28d6e35c0c6dbbb149a8f15f01dc278b76c40eb72dfb20472d6bb367c41d3e39"
                },
                "note": "Internal logging helper used by the payload.",
                "paths": [
                    "extension/ext.logging.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ]
    }
}
References
Credits

Affected packages

VSCode / AzureCdnInfo.edrtester

Package

Name
AzureCdnInfo.edrtester

Affected ranges

Affected versions

1.*
1.0.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/vscode/azurecdninfo.edrtester/MAL-2026-16010.json"