Skip to main content

SUP-COMPROMISE-006 Compromised editor or browser extension

A discovered editor or browser extension matches a catalogued compromised_extension incident. Extensions run with the editor's or browser's authority, so a hit means every token and session that host could see is in scope. This is the same catalog match as EXT-001, reported under this ID when the extension is found by vulkro scan (for example a manifest inside the scanned tree) rather than by vulkro extension-audit.

What Vulkro detects​

Every (ecosystem, identifier, version) found for editor or browser extensions is looked up in the curated compromised-release catalog. A row of kind compromised_extension whose versions[] contains the installed version produces this finding.

Confidence High. Evidence signal: compromised-release-exact-version-match, weight 1.0. Ecosystems: vscode-marketplace (VS Code and its forks), open-vsx, chrome-webstore (Chromium-based browsers), firefox-amo.

Catalogued incidents:

  • INCIDENT-2023-shades-of-purple-vscode (ahmadawais.shades-of-purple@7.0.0, High): a Marketplace typosquat-and-hijack campaign that loaded a remote shell.
  • INCIDENT-2024-cyberhaven-chrome (pajkjnmeojmbapicmbpliphjmcekeaac@24.10.4, Critical): the December 2024 publisher phish that exfiltrated session cookies and identity tokens.
  • INCIDENT-2024-internxt-vpn-chrome (dpggmcodlahmljkhlmpgpdcffdaoccni@1.1.1, High): hit by the same campaign.

Non-compliant code​

A Chrome manifest at .../Chrome/Default/Extensions/pajkjnmeojmbapicmbpliphjmcekeaac/24.10.4/manifest.json; the path encodes the catalogued identifier and version.

{
  "manifest_version": 3,
  "name": "Cyberhaven security extension",
  "version": "24.10.4"
}

Compliant code​

Any version outside the catalogued range is fine.

{
  "manifest_version": 3,
  "name": "Cyberhaven security extension",
  "version": "24.10.5"
}

How to fix​

  • Uninstall the flagged version now.
  • Reinstall a release from before the compromise window or after the publisher's fix; if none exists, leave it uninstalled.
  • Treat the host as compromised for that window: rotate git, npm, cloud CLI and OAuth tokens, session cookies and password-manager sessions.
  • Follow any further guidance in the publisher's incident notice.
  • Run vulkro respond to find the same version elsewhere.

References​

See also: vulkro extension-audit, EXT-001, MCP-006.

Last updated on