Loophole allows threat actors to claim VS Code extension names

ReversingLabs researchers discovered a VS Code Marketplace loophole where names of removed extensions can be reused by any publisher; malicious actors exploited this to publish downloader extensions (e.g., ahban.shiba, ahbanC.shiba) that retrieve a second-stage PowerShell payload from 54.85.145.93 which performs file encryption and demands payment in Shiba Inu tokens. The report documents the timeline, reproduction experiments showing removed names are re-publishable, and provides IOCs and mitigation recommendations, warning of broader supply-chain risks for developers.