MAL-2026-16010
Dashboard / Malicious Package / MAL-2026-16010
MAL-2026-16010
Summary: Malicious code in AzureCdnInfo.edrtester (VSCode)
Details: The Visual Studio Code Marketplace extension `AzureCdnInfo.edrtester` (version 1.0.4) presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, `extension.js` loads `edrdrill.js`, which performs host reconnaissance — hostname, current working directory and local IP — and resolves the Windows domain controller / PDC via DNS SRV and reverse lookups (`ext.dns.js`: `queryDC()` / `queryPDC()`). It then opens an outbound beacon, immediately on activation and every 150 seconds thereafter (`setUpBeaconing()` on a `setInterval`), via an `http.request` to `xeroshoes.com:80` on path `/bcon/` — but it sets the `Host:` header to `officeupdate.southeast.cloudapp.azure-cdn.info` and a decoy browser User-Agent. Because the TCP peer and the advertised host differ, this is HTTP Host-header domain fronting (not SNI). The beacon exfiltrates hostname, local IP and a timestamp under the decoy identity. A reverse-shell function (`phone_home()`) and an AES-decrypt routine are bundled, but in this build the reverse shell is not dispatched (no command handler wires it up) and a second endpoint `goofy.japaneast.cloudapp.azure.com` is commented out, so the active scope is host reconnaissance plus beaconing. The dormant remote-command capability is a trivial change away from being armed. Analysis was static (code + dataflow) on the inert VSIX; no installation, execution, or live callback was performed. Detected and classified independently by codelake Research from the VS Code Marketplace feed; at the time of reporting `AzureCdnInfo.edrtester` was not present in OSV or GHSA (a first-catch).
Affected packages
Package
Name: AzureCdnInfo.edrtester
Purl:
Affected ranges
Type: N/A
Events:
