Taking Down More Malicious VSCode Extensions in the 'Prettier' Campaign - Checkmarx
← Blog

Taking Down More Malicious VSCode Extensions in the ‘Prettier’ Campaign

As adversaries improve their tactics for getting malicious content into the Visual Studio Code Marketplace and Open VSX, Checkmarx Zero continues to defend the community. Here’s the latest brandjacking campaign we took down.

Widescreen graffiti-style cyberpunk illustration showing a dark, gritty wall with a glowing VS Code logo at center, surrounded by fake ‘pro’ extensions like ‘Quarto Pro,’ ‘Profiler PHP Pro,’ and ‘Catppuccin’ painted as corrupted street signs. Neon green and teal dominate the scene, with rough textures, paint splatters, and fractured lines suggesting tampering and impersonation.
Darren Meyer
Darren Meyer

DevSecOps and AppSec research advocate.

Daniel Miranda
Daniel Miranda

I’m a Security Research Intern focused on software supply-chain security. I completed an M.Sc. in Informatics Engineering at Universidade do Minho, specializing in Cryptography and Computer Systems Security, and Formal Methods in Programming.

calendar icon December 5, 2025
reading time icon 6 min. read

The recent campaign of malicious Visual Studio Code (VSCode) extensions that aimed to impersonate the legitimate (and useful!) Prettier code formatter extension appears to have expanded to more extensions, which Checkmarx Zero has worked to remove from the VSCode Marketplace and the alternative Open VSX marketplace.

The extensions follow similar brandjacking tactics as the campaign to impersonate Prettier, with three new tricks:

  1. The adversary is targeting a wider variety of legitimate packages to brandjack, rather than focusing on just one.
  2. The unusually high “installs-to-downloads” ratio suggests the adversary is faking popularity to try to make their packages appear more legitimate; this is combined with using version numbers that appear slightly newer than the legitimate equivalents. In many cases, the install count was in the thousands even though the extension was only downloaded less than 40 times.
  3. These specific malicious VSCode extensions didn’t yet contain a payload. This is a tactic we’ve seen before: cloning legitimate functionality, pushing adoption while the package is safe, and then publishing an auto-installed upgrade that contains the payload at a future time.

We can’t definitively say this is the same adversary as targeted the Prettier name space earlier. But the similarity in basic tactics strongly suggests that it is the same adversary, and that they have evolved their attack in an attempt to target developers using VSCode.

Get security news in your Inbox
visual

Impacted Extensions

Malicious Package Legitimate Equivalent being targeted Marketplace targeted
sqlmtxredev.quarto-pro quarto.quarto
VSCode, Open VSX
senseDevpro.profiler-php-pro DEVSENSE.profiler-php-vscode
VSCode, Open VSX
RooIncVeterinaryDev.roo-cline-pro RooVeterinaryInc.roo-cline
VSCode, Open VSX
DevCatppuccinpro.catppuccin-pro-vsc Catppuccin.catppuccin-vsc
VSCode, Open VSX
devCHOUZZ.vscode-better-align-pro Chouzz.vscode-better-align VSCode, Open VSX
MahendrakarPrateek.prettyxml-pro PrateekMahendrakar.prettyxml Open VSX

Prompt responses from Marketplace maintainers

We’ve had excellent responses from Microsoft (who manage the VSCode Marketplace) and Open VSX alike. Since our reports are all based on human analysis and verification performed by skilled researchers, and since we provide a complete description of what specific indications of malicious behavior led to our report, maintainers are able to promptly verify our report and take decisive action.

In all cases, we were able to identify the packages when they had just a handful of downloads, and the prompt response by maintainers means they were all taken down with under 40 downloads (except senseDevpro.profiler-php-pro, which annoyingly hit 41 downloads before removal).

Follow Checkmarx Zero: