The Mend team has uncovered a fake VS Code extension named truffelvscode, which was typosquatting the popular truffle extension for VS Code. This extension serves as a trojan horse, delivering multi-stage malware. This blog explores how the malicious extension functions, its obfuscation techniques, and the indicators of compromise (IOCs) tied to this incident.
VS Code Extensions
VS Code extensions are additional modules that enhance the functionality of Visual Studio Code by adding new features, themes, debuggers, and other integrations. These extensions help developers personalize their workflow, improve code quality, and integrate with tools like Git, Docker, and AI-based coding assistants. Extensions are typically installed from the VS Code Marketplace.
Package Analysis
The malicious package was published on February 1, 2025. Upon inspection of the code, it was found to contain only two files: package.json and index.js. The package.json file appeared legitimate, with no irregular installation scripts, but it included the same description as the genuine truffle extension: “Build, debug and deploy smart contracts on EVM-compatible blockchains.”
Upon reviewing the index.js file, a heavily obfuscated code was found. With the help of a deobfuscator tool, an ‘exec’ command was identified at the end of the file. This command connects to an external server to download and execute the first stage of the malware.
The Multi-Stage Attack Chain
The attack is designed in multiple stages, with each phase building upon the last to eventually grant the attacker remote control over the compromised system.
Stage 1: Downloading an Obfuscated Batch File
Upon execution, the index.js file starts by downloading an obfuscated batch file. This batch file is obfuscated using the Abobus-obfuscator, a tool that complicates static analysis. The obfuscation hides the true intent of the script and makes it more difficult for automated detection and reverse-engineering tools.
Stage 2: Executing a Malicious DLL
To analyze the behavior of this obfuscated batch file, it was run in an isolated environment. After execution, the fact that the batch file was programmed to download a dynamic-link library (DLL) file through a silent PowerShell WebRequest command was discovered, marking the second stage of the malware. Once the DLL was downloaded, the batch file immediately executed it. This DLL is a key component of the attack, acting as a launcher for the next phase of the infection.
Stage 3: Installing a Preconfigured ScreenConnect Client and Gaining Remote Access
To further investigate the suspicious DLL, it was run through any.run, an online sandbox used for dynamically analyzing malware behavior. The analysis report clearly showed that the goal of the DLL was to download and execute the third and final stage of the malware.
The third stage involved downloading and executing a ScreenConnect installer. ScreenConnect is typically recognized as a legitimate remote desktop application. However, in this case, when the installer was extracted and its files were examined, a system.config file that contained preconfigured details for the remote host, port, and encryption key was found. This configuration allowed ScreenConnect to immediately establish a connection between the compromised machine and the attacker’s system.
To confirm that the connection had indeed been established, the command “netstat -ano | findstr 8041” was run, which showed that analysis was correct.
Conclusion
The discovery of the truffelvscode extension underscores a troubling trend in software supply chain attacks, particularly those targeting developers. By typosquatting, attackers can distribute multi-stage malware that ultimately provides remote access to compromised systems. This incident highlights the need for vigilance when installing VS Code extensions, especially those downloaded from public package registries like npm.
To defend against such threats, developers, and security teams should consider the following measures:
- Verify package authenticity by checking publisher details, download counts, and user reviews.
- Analyze package contents before installation, especially for extensions with minimal files and obfuscated scripts.
- Monitor network activity for suspicious outbound connections, which could indicate malware activity.
- Use automated security scanning tools to detect typosquatting, obfuscation, and malicious dependencies.
As cybercriminals become more creative in their tactics, proactive security measures are essential to protect against software supply chain attacks. Staying informed and using the right security tools will help safeguard development environments from similar threats in the future.
