Malicious VSX Extension "SleepyDuck" Uses Ethereum to Keep Its Command Server Alive

"In the latest instance detected by the enterprise extension security firm, the malware is triggered when a new code editor window is opened or a .sol file is selected. Specifically, it's configured to find the fastest Ethereum Remote Procedure Call (RPC) provider to connect to in order to obtain access to the blockchain, initialize contact with a remote server at "sleepyduck[.]xyz" (hence the name) via the contract address " 0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465," and kicks off a polling loop that checks for new commands to be executed on the host every 30 seconds."

"According to Secure Annex's John Tuckner, the extension in question, juan-bianco.solidity-vlang (version 0.0.7), was first published on October 31, 2025, as a completely benign library that was subsequently updated to version 0.0.8 on November 1 to include new malicious capabilities after reaching 14,000 downloads. "The malware includes sandbox evasion techniques and utilizes an Ethereum contract to update its command and control address in case the original address is taken down," Tuckner added. Campaigns distributing rogue extensions targeting Solidity developers have been repeatedly detected across both the Visual Studio Extension Marketplace and Open VSX."

"In July 2025, Kaspersky disclosed that a Russian developer lost $500,000 in cryptocurrency assets after installing one such extension through Cursor. It's also capable of gathering system information, such as hostname, username, MAC address, and timezone, and exfiltrating the details to the server. In the event the domain is seized or taken down, the malware has built-in fallback controls to reach out to a predefined list of Ethereum RPC addresses to extract the contract information that can hold the server details."

The Open VSX extension juan-bianco.solidity-vlang was initially published as a benign library on October 31, 2025 and updated to a malicious release (version 0.0.8) on November 1 after surpassing 14,000 downloads. The extension contains the SleepyDuck remote access trojan that triggers when a new code editor window opens or a .sol file is selected. The malware finds the fastest Ethereum RPC, contacts sleepyduck[.]xyz via contract 0xDAfb81732db454DA238e9cFC9A9Fe5fb8e34c465, and polls every 30 seconds for commands. Capabilities include sandbox evasion, system reconnaissance (hostname, username, MAC, timezone), data exfiltration, and fallback mechanisms using Ethereum contracts and RPC lists for resilient command-and-control.

Read at The Hacker News