Hackers Infiltrate VS Code Marketplace with 19 Malicious Extensions Posing as PNG File

Security researchers uncovered a coordinated supply-chain malware campaign on the VS Code Marketplace involving 19 malicious extensions that weaponized the popular "path-is-absolute" npm package to conceal a base64/string-reversed JavaScript dropper inside PNG image files; the dropper uses cmstp.exe to deploy two binaries (including a Rust-based trojan) and remained active since February 2025, contributing to a sharp rise in VS Code malware detections.