Yeeth Security

AI enhanced malware detection and threat intelligence for the developer supply chain

[Yeeth Security @YeethSecurity]

🚀 300M monthly downloads and growing!

We’re proud to have developed a pipeline for the @EclipseFdn to harden the security infrastructure of the Open VSX Registry. Great to see this milestone and the new AWS investment featured in @TheNewStack!

Check out the full story: https://t.co/ZANcKqyKhT

[Yeeth Security @YeethSecurity]

@tuckner Guess what this one does 👇

[Yeeth Security @YeethSecurity]

Caught a live one in the VS Code Marketplace! Stay tuned for more - https://t.co/lSB06AjbNR

[Yeeth Security @YeethSecurity]

HTTP/2 Bomb: Codex chained two decade-old HTTP/2 tricks (HPACK index bomb + zero-window stall) into CVE-2026-49975

https://t.co/nGjOwsz9f1

[Yeeth Security @YeethSecurity]

We can confirm as of 18:30 UTC today the Open VSX extensions published by Red Hat have not been affected as a part of this campaign so far

[International Cyber Digest @IntCyberDigest]

🚨 UPDATE: Red Hat has now published RHSB-2026-006 confirming the supply chain compromise affecting multiple npm packages under the redhat-cloud-services namespace.

[Yeeth Security @YeethSecurity]

Quick drop: codexui-android (27k weekly DLs) reads ~/.codex/auth.json and exfils your OpenAI refresh token to sentry.anyclaw[.]store/startlog

Payload's only in the npm tarball, never the GitHub repo

Refresh tokens don't expire = forever Codex access:
https://t.co/EQKmTVoaM7

[Yeeth Security @YeethSecurity]

Everyone's watching npm.

NuGet just shipped Sicoob.Sdk (2.0.0–2.0.4): a fake C# SDK for a Brazilian bank that reads your .pfx and exfils the cert + password through a Sentry endpoint, disguised as app telemetry.

Clean source repo, trojaned binary...https://t.co/3csRz2oBiv

[Yeeth Security @YeethSecurity]

cc: @Ionut_Ilascu @billtoulas @TheHackersNews
@BleepinComputer @DarkReading @vxunderground

[Yeeth Security @YeethSecurity]

🔥 Huge milestone for the team today: We pissed off a threat actor so badly they cloned our co-founder's name on Open VSX and tried to gaslight our LLM with prompt injection 😭

Imagine putting this much effort into a dropper that's dead on arrival

Enjoy these hilarious screenshots of their desperation 👇

[Yeeth Security @YeethSecurity]

cc: @TheHackersNews @BleepinComputer @DarkReading @SocketSecurity @billtoulas

[Yeeth Security @YeethSecurity]

🚨 LIVE NOW 🚨
A Deeper Look at GLASSWORM's Solana Variant

Check out our triage and reversing of an ongoing campaign targeting Open VSX and, by extension, your IDE

https://t.co/zTYxQCSuJp

[Yeeth Security @YeethSecurity]

These extensions contain artifacts from GLASSWORM - one we analyzed contains a compiled executable with anti‑VM behavior and extracts an embedded payload to execute in memory.

A report with our deep analysis will be published soon. Links for awareness:

- https://t.co/LCoGF5xQ6l
- https://t.co/ZS0ynuoYeh
- https://t.co/EYVb6Xtyau

[Yeeth Security @YeethSecurity]

These extensions contain artifacts from GLASSWORM - one we analyzed contains a compiled executable with anti‑VM behavior and extracts an embedded payload to execute in memory.

A report with our deep analysis will be published soon. Links for awareness:

- https://t.co/LCoGF5xQ6l
- https://t.co/ZS0ynuoYeh
- https://t.co/EYVb6Xtyau

[Yeeth Security @YeethSecurity]

⚠️ Avoid this malicious package on Open VSX - We are currently working on having it taken down

[Yeeth Security @YeethSecurity]

A couple more to be weary of, analyzed and reported

[Yeeth Security @YeethSecurity]

⚠️ Avoid this malicious package on Open VSX - We are currently working on having it taken down

[Yeeth Security @YeethSecurity]

VS Code marketplace rarely tags an extension straight as Malware

Most takedowns get ‘Impersonation’

Today we got Sm1lerrpasy.ton-func-syntax-highlighter. TON FunC = Telegram-chain smart contract devs = wallets w/ TON keys.

https://t.co/zB2myGh3Qx

[Yeeth Security @YeethSecurity]

The absolute weaponized brainrot in the beg bounty scene right now.

Some genius uploaded an Antigravity IDE "0day sandbox escape" to Open VSX...that bypasses a sandbox to grant you the exact local privileges the extension already had.

Brilliant execution, you broke into a house you were already sitting inside 💀

[Yeeth Security @YeethSecurity]

@shfx @jonahseguin We've seen discussion around safe-npm, pnpm, and yarn

[Yeeth Security @YeethSecurity]

New GitHub account: dfghjhjke

[Yeeth Security @YeethSecurity]

Yeeth Security is tracking another campaign of GLASSWORM adjacent extensions targeting Open VSX 👇

The campaign polls Solana mainnet for a memo transaction on the threat actors wallet and decrypts the memo for the next-stage C2 domain to fetch and execute a binary

Windows and Linux machines are targeted, but notably the Linux payload is missing

The Windows payload sets a registry run key masquerading as a windows defender backup artifact that installs a self updating RAT

[Yeeth Security @YeethSecurity]

Solana address: 6ExrZayPZzMMSnszc42cH81DpuKT8FhCX9H6Sesn6rpz

GitHub accounts:
- JohnMillDoe
- Aljsnedfjn
- Kbaefkjbd
- kdjrgndjsdf

HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\DefenderBackup

[vxdb @vxdb]

I've updated the meme