Unverified50% confidenceFactExact time
After running, the extension performed operations such as collecting detailed system information, reading the user's git email address, enumerating environment variable names, attempting to add an SSH key controlled by the attacker, opening a reverse tunnel, and setting up auxiliary persistence mechanisms.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
11/1/2026
First Seen
Valid until: 1/30/2027
Sources
Related Entities
Related Claims
UnverifiedThe malicious extension collects hostnames, usernames, system architecture and public IP addresses, and writes the attacker's email into the authorization file to establish a reverse-tunnel backdoor.78% similarUnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.73% similarUnverifiedPersistence is the general term for techniques attackers use to maintain access after an initial intrusion, with common methods including writing SSH public keys to ~/.ssh/authorized_keys, creating system services or scheduled tasks, modifying shell startup scripts, and implanting browser extensions or login items.70% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果70% similarUnverifiedOnce an attacker gains access to the Monorepo repository, they can often simultaneously access source code across multiple product lines, embedded API keys and service account credentials, CI/CD pipeline configurations, and infrastructure-as-code files67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1123388API
curl https://kongchang.com/api/v1/knowledge/claims/1123388MCP
get_claim(id=1123388)