Skip to main content

EXT-001 Known-compromised extension version

An installed extension's (ecosystem, identifier, version) matches a catalogued supply-chain incident. Editor extensions can read every buffer, project and cached git token; browser extensions see every tab and request. Treat a hit as a session-token incident for everything the host can reach.

What Vulkro detects​

The rule fires when the catalog's lookup(ecosystem, identifier, version) returns a hit. Severity comes from the catalog row:

  • Critical: INCIDENT-2024-cyberhaven-chrome at version 24.10.4 (the December 2024 Chrome publisher phish).
  • High: INCIDENT-2024-internxt-vpn-chrome (same cluster) and the 2023 Shades of Purple VS Code typosquat campaign.

Confidence is always High (exact-string match). Evidence signal: extension-compromised-version, weight 1.0, source Pattern.

Ecosystems: vscode-marketplace (VS Code and its forks), open-vsx, chrome-webstore (Chromium-based browsers) and firefox-amo. The catalog refreshes through the signed update bundle (vulkro update); a baked-in copy covers fresh and offline installs.

Non-compliant code​

A Chromium manifest at .../Chrome/Default/Extensions/pajkjnmeojmbapicmbpliphjmcekeaac/24.10.4/manifest.json. The path's extension ID and version match the catalog row exactly.

{
  "manifest_version": 3,
  "name": "Cyberhaven security extension",
  "version": "24.10.4",
  "permissions": ["storage", "tabs"],
  "host_permissions": ["<all_urls>"]
}

Compliant code​

The same identifier at the publisher's patched release no longer matches.

{
  "manifest_version": 3,
  "name": "Cyberhaven security extension",
  "version": "24.10.5",
  "permissions": ["storage", "tabs"],
  "host_permissions": ["<all_urls>"]
}

How to fix​

  • Uninstall the flagged version now (chrome://extensions in the browser, or the Extensions panel in the editor).
  • Reinstall a release from before the compromise window or after the publisher's fix. If none exists, leave it uninstalled.
  • Treat the host as compromised for the time the bad version was active: rotate git, npm, cloud CLI and OAuth tokens, session cookies and password-manager sessions.
  • Follow any further guidance in the publisher's incident notice.

References​

See also: vulkro extension-audit, EXT-002, SUP-COMPROMISE-006.

Last updated on