MAL-2025-191161 Malicious code in ginfuru.better-nunjucks (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c1f105a5bf6daf41b694f7cc339589ac86e57964dd2f761bc04b8ea20fe70ae8 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

MAL-2025-191168 Malicious code in sissel.shopify-liquid (VSCode:https://open-vsx.org)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8174c373fd818eb48388777436e30f84dcf0846593fcbddc3e73f898858a4317 This extension is malicious. When installed it runs an info stealer that exfiltrates user data including credentials and cryptocurrency...

Malicious code in @vscode-bicep-ui/components (npm)

The package @vscode-bicep-ui/components was found to contain malicious code...

EUVD-2020-5539

Malware in sbrugna...

EUVD-2021-18811

Malware in sbrugna...

EUVD-2021-18314

Malware in sbrugna...

EUVD-2021-17064

Malware in sbrugna...

EUVD-2021-16132

Malware in sbrugna...

EUVD-2021-15450

Malware in sbrugna...

CVE-2025-61680

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0...

EUVD-2022-38802

Malicious code in bioql PyPI...

EUVD-2024-52974

Malicious code in bioql PyPI...

EUVD-2021-9680

Malicious code in bioql PyPI...

EUVD-2023-50478

Malicious code in bioql PyPI...

EUVD-2021-9341

Malicious code in bioql PyPI...

EUVD-2021-8705

Malicious code in bioql PyPI...

EUVD-2022-0826

Malicious code in bioql PyPI...

EUVD-2025-19068

Malicious code in bioql PyPI...

EUVD-2022-38803

Malicious code in bioql PyPI...

Malicious Package

Overview plonkscript-vscode is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...