目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡
← 返回恶意软件包
VSCode:https://open-vsx.org active

checkmarx.ast-results

MAL-2026-2231
2026-03-26 06:18:28
OpenSSF Malicious Packages
该软件包被识别为恶意包。建议隔离受影响环境，并排查凭据泄露和异常网络连接。

Summary

Malicious code in checkmarx.ast-results (VSCode:https://open-vsx.org)

凭据/密钥窃取文件/数据外传
AI 分析整理qwen3.6
基于上游报告生成，请以下方原始证据为准。
公开使用量数据
统计周期
—
下载量
—
数据源
暂无公开数据
下载量只代表仓库活动度，不等于已被入侵的安装数量。
受影响版本
EcosystemPackageVersion
VSCode:https://open-vsx.orgcheckmarx.ast-results*
VSCode:https://open-vsx.orgcheckmarx.ast-results2.35.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.36.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.37.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.38.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.39.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.40.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.42.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.43.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.44.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.45.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.46.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.47.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.48.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.49.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.49.1772191521
VSCode:https://open-vsx.orgcheckmarx.ast-results2.49.1772192163
VSCode:https://open-vsx.orgcheckmarx.ast-results2.50.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.51.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.52.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.53.0
VSCode:https://open-vsx.orgcheckmarx.ast-results2.56.0
恶意行为说明OpenSSF OSV
上游来源证据
展开原始 OSV JSON
{"modified":"2026-03-26T06:18:28Z","published":"2026-03-26T06:18:28Z","schema_version":"1.7.4","id":"MAL-2026-2231","summary":"Malicious code in checkmarx.ast-results (VSCode:https://open-vsx.org)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (3205937565e6fad63cbece12a8463cd52f3e95c10ac99ab7e62a317e9c18717a)\nThis extension is a compromised version of the offical Checkmarx VSCode extensions\navailable on the Microsoft Marketplace, by the TeamPCP threat actor and related\nto the Trivy campaign.\n\nThe extension hunts for sensitive credentials and developer secrets for\nexfiltration. The extension also downloads a payload from an attacker\ncontrolled server. The malicious code will also try and maintain persistence\nusing systemd.\n","affected":[{"package":{"ecosystem":"VSCode:https://open-vsx.org","name":"checkmarx.ast-results"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.0"}]}],"versions":["2.56.0","2.53.0","2.52.0","2.51.0","2.50.0","2.49.1772192163","2.49.1772191521","2.49.0","2.48.0","2.47.0","2.46.0","2.45.0","2.44.0","2.43.0","2.42.0","2.40.0","2.39.0","2.38.0","2.37.0","2.36.0","2.35.0"]}],"references":[{"type":"REPORT","url":"https://checkmarx.com/blog/checkmarx-security-update/"},{"type":"ARTICLE","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"type":"ARTICLE","url":"https://www.reversinglabs.com/blog/teampcp-supply-chain-attack-spreads"}],"database_specific":{"iocs":{"domains":["checkmarx.zone"]},"malicious-packages-origins":[{"import_time":"2026-03-26T06:18:48.132467Z","modified_time":"2026-03-26T06:18:28Z","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.58.0"}],"type":"ECOSYSTEM"}],"sha256":"3205937565e6fad63cbece12a8463cd52f3e95c10ac99ab7e62a317e9c18717a","source":"google-open-source-security","versions":["2.56.0","2.53.0","2.52.0","2.51.0","2.50.0","2.49.1772192163","2.49.1772191521","2.49.0","2.48.0","2.47.0","2.46.0","2.45.0","2.44.0","2.43.0","2.42.0","2.40.0","2.39.0","2.38.0","2.37.0","2.36.0","2.35.0"]}]}}

数据来源：OpenSSF Malicious Packages · Apache-2.0