A new playground: Malicious campaigns proliferate from VSCode to npm

ReversingLabs researchers tracked a campaign that distributed downloader malware through malicious Visual Studio Code extensions and an associated npm package (etherscancontracthandler). The malicious artifacts used obfuscated JavaScript to fetch second-stage payloads from shared domains, impersonated legitimate tools (including crypto tooling and Zoom), and exhibited fabricated install counts and reviews; while VSCode Marketplace removals occurred, the actor expanded to npm, increasing potential supply-chain exposure. The report lists IOCs, notes the npm package had ~350 downloads, and recommends preapproval, validation, and regular security assessments of IDE plugins and dependencies to mitigate development-environment compromise.