StepSecurity
A cybersecurity company focused on software supply chain security. It provides security analysis and threat detection services for CI/CD and developer tools.
Timeline (last 90 days)
Analysis by the security firm StepSecurity shows that uninstalling the extension may not be enough to clear all traces.
The malicious code executes immediately when the extension loads, without requiring the user to actively trigger any feature.
After running, the extension performed operations such as collecting detailed system information, reading the user's git email address, enumerating environment variable names, attempting to add an SSH key controlled by the attacker, opening a reverse tunnel, and setting up auxiliary persistence mechanisms.
The report specifically mentions an item named "SVC telemetry key" that needs to be checked; such naming often disguises itself as a system or telemetry component.
All Facts (4)
Analysis by the security firm StepSecurity shows that uninstalling the extension may not be enough to clear all traces.
50%UnverifiedThe malicious code executes immediately when the extension loads, without requiring the user to actively trigger any feature.
50%UnverifiedAfter running, the extension performed operations such as collecting detailed system information, reading the user's git email address, enumerating environment variable names, attempting to add an SSH key controlled by the attacker, opening a reverse tunnel, and setting up auxiliary persistence mechanisms.
50%UnverifiedThe report specifically mentions an item named "SVC telemetry key" that needs to be checked; such naming often disguises itself as a system or telemetry component.
50%