{"answers":{"affected":"1 open source package ship an affected version, including AzureCdnInfo.edrtester.","exploited":"There is no known exploitation of MAL-2026-16010 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16010 is a malicious package in AzureCdnInfo.edrtester, published on 3 Sep 2026."},"fix_prompt":"MAL-2026-16010 is a malicious package: AzureCdnInfo.edrtester (VSCode). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16010/ (Markdown: https://insights.sbomify.com/MAL-2026-16010/index.md)","id":"MAL-2026-16010","markdown":"https://insights.sbomify.com/MAL-2026-16010/index.md","name":"MAL-2026-16010","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The Visual Studio Code Marketplace extension `AzureCdnInfo.edrtester` (version 1.0.4) presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, `extension.js` loads `edrdrill.js`, which performs host reconnaissance — hostname, current working directory and local IP — and resolves the Windows domain controller / PDC via DNS SRV and reverse lookups (`ext.dns.js`: `queryDC()` / `queryPDC()`).\n\nIt then opens an outbound beacon, immediately on activation and every 150 seconds thereafter (`setUpBeaconing()` on a `setInterval`), via an `http.request` to `xeroshoes.com:80` on path `/bcon/` — but it sets the `Host:` header to `officeupdate.southeast.cloudapp.azure-cdn.info` and a decoy browser User-Agent. Because the TCP peer and the advertised host differ, this is HTTP Host-header domain fronting (not SNI). The beacon exfiltrates hostname, local IP and a timestamp under the decoy identity.\n\nA reverse-shell function (`phone_home()`) and an AES-decrypt routine are bundled, but in this build the reverse shell is not dispatched (no command handler wires it up) and a second endpoint `goofy.japaneast.cloudapp.azure.com` is commented out, so the active scope is host reconnaissance plus beaconing. The dormant remote-command capability is a trivial change away from being armed. Analysis was static (code + dataflow) on the inert VSIX; no installation, execution, or live callback was performed.\n\nDetected and classified independently by codelake Research from the VS Code Marketplace feed; at the time of reporting `AzureCdnInfo.edrtester` was not present in OSV or GHSA (a first-catch).","ecosystems":["VSCode"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in AzureCdnInfo.edrtester (VSCode)","id":"MAL-2026-16010","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"VSCode","fixed":[],"introduced":[],"last_affected":[],"package":"AzureCdnInfo.edrtester","purl":null,"source":"MAL-2026-16010"}],"products":null,"published":"2026-09-03","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16010/"}