Cybersecurity researchers have identified two dangerous extensions in the Visual Studio Code Marketplace that were designed to deploy ransomware to unsuspecting users. The extensions, “ahban.shiba” and “ahban.cychelloworld,” have been removed from the marketplace after discovery.

According to ReversingLabs, both extensions contained code that triggered PowerShell commands to fetch and execute malicious payloads from command-and-control servers. The payload appears to be ransomware in early development stages, as it only encrypts files within a “testShiba” folder on the victim’s Windows desktop.

After encryption, victims receive a message demanding “1 ShibaCoin to ShibaWallet” for file recovery, but no payment instructions or wallet addresses are provided—further suggesting this is malware still under development.

This discovery follows similar incidents from recent months when researchers identified other malicious extensions masquerading as legitimate software like Zoom, which downloaded unknown secondary payloads from remote servers.

In a related development last week, Socket reported a malicious Maven package impersonating the scribejava-core OAuth library. This package secretly harvests OAuth credentials on the fifteenth day of each month, using a time-based trigger to avoid detection. Despite being uploaded to Maven Central in January 2024, it remains available for download.

The attackers employed typosquatting techniques, creating nearly identical package names to trick developers. The malicious package has six dependent packages that also use typosquatting but share the same groupId (io.github.leetcrunch) instead of the legitimate namespace (com.github.scribejava), creating a false sense of legitimacy to increase adoption by developers.