Researchers have uncovered a malicious Visual Studio Code extension that secretly installs a remote access trojan (RAT) dubbed SleepyDuck, marking yet another sophisticated attack on the developer ecosystem.
The Discovery
Security researcher John Tuckner (Secure Annex) reported that the juan-bianco.solidity-vlang extension was initially uploaded to the Open VSX registry on October 31, 2025, as a harmless Solidity library.
One day later, on November 1, it was updated to version 0.0.8 with new malicious functionality — after surpassing 14,000 downloads.
“The malware includes sandbox evasion techniques and uses an Ethereum contract to update its C2 address if the original is taken down,” Tuckner explained.
How SleepyDuck Works
Once installed, the malicious extension activates when:
- A new code editor window is opened, or
- A .sol (Solidity) file is accessed.
From there, it:
- Connects to the fastest Ethereum Remote Procedure Call (RPC) provider.
- Retrieves command-and-control (C2) data via the smart contract
0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465. - Communicates with the domain sleepyduck[.]xyz every 30 seconds to poll for commands.
- Exfiltrates system details such as hostname, username, MAC address, and timezone.
- Updates C2 details through the Ethereum blockchain if the primary server is taken down — a rare example of blockchain-assisted persistence.
The malware also includes a failsafe mechanism to issue “emergency commands” across infected endpoints.
Possible Manipulation of Downloads
Analysts suspect the 14,000+ download count was artificially inflated to improve visibility in search results — a common tactic used to lure unsuspecting developers.
“The download counts likely are manipulated,” said Tuckner. “This is done to make it more relevant in search results for Cursor/Open VSX.”
More Malicious Extensions Found
Secure Annex also identified a set of five additional VS Code extensions published by a user named developmentinc, including a Pokémon-themed plugin that:
- Downloads a batch script from mock1[.]su,
- Launches it with administrator privileges,
- Disables Microsoft Defender exclusions, and
- Deploys a Monero cryptocurrency miner.
These have now been removed from the marketplace.
Protection and Best Practices
- ⚙️ Only install extensions from verified publishers.
- 🔍 Check Microsoft’s RemovedPackages GitHub page for removed or malicious extensions.
- 💾 Keep Visual Studio Code and extensions updated.
- 🧰 Use endpoint monitoring and EDR visibility for developer workstations.
Alcaeus Services Insight
This incident highlights how developer ecosystems are increasingly exploited for supply chain attacks.
At Alcaeus Services, we help organizations secure their software pipelines by:
- Auditing code editor extensions and dependencies.
- Implementing Zero Trust developer workspace.
- Deploying threat monitoring for code repositories and marketplaces.
Developers are the new target — protect your tools as much as your code.
