North Korean Backdoor Hid in VS Code Marketplace Extension, Threatening Developers
Security researchers uncovered a VS Code Marketplace extension, jupyter-powerdev, that contains a multi-stage backdoor linked to DPRK intelligence. The malware uses Microsoft Graph and SharePoint for encrypted C2, and deploys Windows and Linux agents to exfiltrate code and execute commands. Its supply-chain placement puts any developer who installs it at instant risk.