SaassyCode Repackaged: Four New VS Code Extensions and a New Delivery Chain

Knostic identified four VS Code extensions that reuse malicious code from the SaassyCode family. They reveal two distinct forms of reuse: one package was republished almost unchanged, while three others were rebuilt around reused source code.

Our previous research documented 24 extensions in the SaassyCode family. These four are additional Marketplace listings that reuse SaassyCode code: one republishes an already-documented package, while three reuse the TrelloBlox source. This investigation builds on our original SaassyCode disclosure and our analysis of the post-disclosure wave.

ManageRBLX123 is an almost exact repackaging of ManageRBLX 4.9.5, one of the two extensions in our original June disclosure. Someone changed five lines of metadata and republished the package, dropper and all.

FocusDeck, Trello Deck, and Swimlane represent a different kind of reuse. All three are built on TrelloBlox 5.7.0’s source code, but its original dropper—a remote script written to the temporary directory and executed through Windows Script Host—was removed. Instead, activate() calls a small loader that spawns a detached Node process using the editor’s own binary. That process runs an install script located inside a bundled dependency, which downloads and executes the payload.

That change matters more than the rebranding. The original chain left two clear indicators: a cscript.exe child process and a file named nice.js in %TEMP%. The replacement removes both while preserving the same download-and-execute behavior. The code lineage is confirmed in all four extensions, but that does not establish who repackaged or rebuilt them.

Extensions at a glance

Install counts are point-in-time Marketplace observations, not confirmed infections. Together, the three source derivatives had 2,254 observed installs across the dates shown.

Lineage and execution flow

The diagram shows the two reuse patterns. The left branch preserves ManageRBLX’s original package and execution chain. The right branch preserves TrelloBlox’s application code but replaces its inline dropper with a new loader and dependency-based delivery chain.

How we established the SaassyCode connection

The two groups require different evidence. ManageRBLX123 is established through a byte-level comparison of two VSIX archives. The other three are established through source-level comparison with TrelloBlox 5.7.0.

ManageRBLX123: exact repackaging

ManageRBLX123 5.0.5 and ManageRBLX 4.9.5 differ by five lines, spread across two metadata files. Six of the eight archive entries are byte-identical, including extension/src/extension.js, the file that carries the dropper.

--- extension/package.json - "displayName": "ManageRBLX", + "displayName": "ManageRBLX12222", - "version": "4.9.5", - "publisher": "GeorgeXBT", + "version": "5.0.5", + "publisher": "testpublisher610",  --- extension.vsixmanifest - <Identity Id="managerblx" Version="4.9.5" Publisher="GeorgeXBT" /> - <DisplayName>ManageRBLX</DisplayName> + <Identity Id="managerblx123" Version="5.0.5" Publisher="testpublisher610" /> + <DisplayName>ManageRBLX123</DisplayName>

Because extension.js was untouched, the original execution chain came with it: activate() downloads newly.js from giantapplebees[.]shop, saves it as %TEMP%\nice.js, and executes it with cscript //nologo //e:jscript. The description, activation events, icons, and README were also carried over unchanged. The manifest identity was updated, but the name field in package.json still reads managerblx.

The original package also retained internal TaskBlox identifiers, including the command taskblox.open and the panel ID taskblox-board. These identifiers survived unchanged in ManageRBLX123.

The byte-identical malicious files establish package lineage conclusively, but they do not identify who republished the package. The minimal metadata-only change is consistent with either malicious republishing or a researcher testing whether a known sample would still be detected under a new identity.

ManageRBLX123: original delivery chain

FocusDeck, Trello Deck and Swimlane: TrelloBlox source reuse

Each of the three ships an extension/src/extension.js that is TrelloBlox 5.7.0’s file with 2,263 of its 2,294 lines byte-identical. About a dozen branding strings were changed, the malicious block was removed, and one line was added to call a new loader. The rest — a complete working Kanban webview with its own state model, drag-and-drop, activity feed and JSON export — was carried over as it stood.

The strongest lineage markers are arbitrary implementation details that would be unlikely to appear independently.

• The arbitrary global-state keys rb_workspaces and rb_activeId appear in TrelloBlox and all three derivatives.
• The default board is created by makeWorkspace('My Game', 'Owner'), a game-development default surviving inside three products that present themselves as generic project planners.

FocusDeck carries a command mismatch. Its package.json contributes FocusDeck.open, but the code registers fluxBoard.open and its error text says “Flux Board”. The rebrand reached the manifest and not the source, so the extension’s only user-facing command does not work at all.

TrelloBlox imports child_process and https for its original dropper. All three derivatives retain those now-unused imports. FocusDeck and Trello Deck add require('./patt'), while Swimlane adds require('./package'), which points to its obfuscated package.js loader. These are clear remnants of the original dropper being removed and replaced.

These artefacts were not included in Knostic’s public reporting, so copying our write-ups does not explain the overlap. However, the original VSIX was publicly available, and a third party could have extracted and modified its source.

FocusDeck, Trello Deck and Swimlane: new delivery chain

With the inline dropper removed, delivery moves out of extension.js and into code stored inside a bundled dependency. The extension still initiates the chain through its activate() function.

The first stage is a small loader. FocusDeck and Trello Deck contain a byte-identical plaintext loader at extension/src/patt.js. Swimlane uses an obfuscated implementation of the same loader behavior at extension/src/package.js. Its purpose is to locate an install script inside the bundled dependency and launch it:

const child = spawn(nodeBinary, [installScript], {   cwd: path.dirname(installScript),   detached: true,   stdio: 'ignore',   windowsHide: true,   env: { ...process.env, ELECTRON_RUN_AS_NODE: '1' } }); child.unref();

The loader sets ELECTRON_RUN_AS_NODE=1, causing the Electron executable used by VS Code to run as a Node.js process. This allows it to execute the bundled install script without requiring a separate Node.js installation. The process is detached, its standard input and output are discarded, and its console window is hidden on Windows.

The script launched by the loader is already packaged inside the VSIX. FocusDeck and Trello Deck bundle a dependency named boardflow, version 1.2.1, whose package.json declares "preinstall": "node install.js". Swimlane contains a closely related bundled dependency named typescripts, also version 1.2.1, which declares "preinstall": "node lolnstall.js".

These dependencies contain extension-specific payload URLs and are delivered inside the VSIX. We therefore found no evidence that their presence resulted from the compromise of an independently maintained upstream npm package.

The declared preinstall hooks are not what triggers execution. No npm install occurs at runtime. Instead, activate() calls the loader directly, and the loader launches the bundled install script.

Each install script contains a small obfuscated downloader built from the same general template. It creates a destination under the temporary directory, uses curl -L -o to retrieve a file, and then executes the downloaded path. Each extension uses a different hard-coded URL and destination filename:

This replacement chain removes the two specific artifacts associated with the original SaassyCode dropper: it does not launch cscript.exe, and it does not create %TEMP%\nice.js. It introduces a different set of observable files and process behaviors instead.

What the evidence supports

Code and package lineage is confirmed. ManageRBLX123 preserves the malicious code from ManageRBLX 4.9.5 unchanged, while FocusDeck, Trello Deck and Swimlane reuse TrelloBlox 5.7.0’s source code.

The evidence also supports coordinated packaging of the three TrelloBlox derivatives with high confidence. FocusDeck and Trello Deck contain a byte-identical loader, while Swimlane contains an obfuscated implementation of the same behavior. The three packages bundle closely related dependencies derived from the same template, with extension-specific install scripts and payload URLs. They also share the same obfuscation approach and byte-identical LICENSE.txt and desktop.ini files, providing additional evidence of a shared packaging environment.

What the evidence does not establish is whether the original SaassyCode operator published any of these extensions. The original VSIX files were publicly obtainable, so reuse by a third party remains a reasonable alternative. We therefore attribute the four extensions to the SaassyCode code lineage, but not necessarily to the same operator.

Indicators of compromise

Reference samples

Conclusion

One extension republished ManageRBLX with five metadata lines changed and its dropper intact. Three more reused the TrelloBlox source and replaced its Windows Script Host dropper with a loader that runs a bundled dependency's install script through the editor's own Node runtime. These samples demonstrate continued reuse and modification of the SaassyCode codebase.

Previous reporting

• New VS Code Extensions Attack Campaign: SaassyCode — ManageRBLX and TrelloBlox (1 June 2026) — the original disclosure of the two extensions used as baselines here.
• Update and Infect: How the SaassyCode Campaign Grew from Two Extensions to Nineteen (8 June 2026) — the full campaign family and its cluster structure.
• SaassyCode Post-Disclosure Wave: Five New Extensions, 32,000+ Total Installs (11 June 2026) — the wave that followed our disclosure.