Fake Prettier Extension on VSCode Marketplace Dropped Anivia Stealer
Source Reddit InfoSec News
Description
A fake Prettier extension was uploaded to the VSCode Marketplace, which deployed the Anivia stealer malware. This malicious extension targets developers by masquerading as a legitimate code formatting tool, aiming to steal sensitive information from infected systems. Although no known exploits in the wild have been reported yet, the presence of malware in a trusted software repository poses a significant risk. European organizations using VSCode and its extensions are at risk of data theft and potential compromise of developer environments. The threat requires vigilance in extension sourcing and verification. Mitigation involves strict extension vetting, use of endpoint protection, and monitoring for unusual data exfiltration. Countries with large software development sectors and high VSCode usage, such as Germany, the UK, and France, are more likely to be affected. Given the medium severity rating, the threat impacts confidentiality primarily, with moderate ease of exploitation due to user installation of the extension. Defenders should prioritize verifying extension authenticity and educating developers about supply chain risks.