⚠️ WARNING — SECURITY RISK: Uncontrolled Outbound Traffic at Extremely High Rates Triggered Without User Interaction #452
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
Summary
This extension (
Zignd.html-css-class-completion, Visual Studio Marketplace) silently crawls all HTML files in the workspace — including unopened files — and initiates network requests to every external URL it finds. This behavior triggers uncontrolled, extremely high rates of outbound traffic without user interaction, and without any throttling or validation.During testing, we observed over 100,000 network requests in under a minute. On a larger scale, such behavior could inadvertently cause major operational issues, expose users to security risks, and potentially facilitate denial-of-service (DoS) attacks against third-party targets through request amplification.
Disclaimer
We are not alleging malice or intent. This report only presents observed behaviors and the associated risks.
Background Context
This behavior was discovered while working on a project involving the recovery and reconstruction of a legacy website, the domain of which had been poached for its exceptional SEO in early 2024. The domain is now monetized through low-effort, high-volume referral scams, while mimicking every last URL and file structure of the former site.
The attackers heavily rely on redirects to funnel users across multiple domains under their control — a detail that will become important later.
As part of our project, we recovered substantial static HTML and CSS files from the original site, storing them locally within a broader project workspace. We began the project on 2025-04-15 and initially opened only a handful of files for examination.
Importantly, the behavior described here does not require any of the files to be opened — presence alone is sufficient.
For completeness: the workspace was marked as Trusted in VS Code.
First Observations
The first anomaly was detected through Little Snitch, a macOS application-layer firewall.
Shortly after downloading the files, Little Snitch flagged a massive burst of outbound network traffic. This initially went unnoticed until several hours later, by which point the outbound data had more than tripled the size of the downloaded files.
The destination matched the new redirect domain associated with the compromised legacy site, raising concerns of silent data exfiltration to a potential command-and-control (C2) server.
Initial attempts to block the IPs directly were abandoned due to their use of Cloudflare infrastructure. Instead, we blocked the domain at the DNS level via Little Snitch and moved on — until today, when the problem re-emerged.
Relation to the Extension
Approximately 10 days passed since our initial observation. To be honest (and, admittedly, maybe too optimistic), we had nearly forgotten about the incident.
Today, we observed the following in the Little Snitch network monitor:
Though not fully depicted in the screenshot, these connections clearly originated from VS Code, Electron, and the VS Code Helper process(es).To investigate what was going on with VS Code, we set the log level to
trace, let it run for a few minutes, and reloaded the VS Code window ([CMD]+[SHIFT]+[P]→Developer: Reload Window) a few times.What we discovered was both frustrating and absurd. The timestamps below span roughly ~2000 log lines, almost uniform in their debug and trace output:
This pattern continued by the thousands.
The network monitor revealed an even more shocking scale:
Confirming the Source of the Problem
Unfortunately, the traces and debug logs do not provide clear attribution to the originating extension or code.
We conducted an extension bisect — nearly working through all ~140 installed extensions — to finally determine the culprit. Once identified, the cause became obvious.
To confirm the extension was indeed the source of the problem, we simply toggled it from
enabledtodisableda handful of times — each time, immediately being met with a burst of traffic.Explanation and Suspected Cause
The extension, as described in its documentation, is designed to scan HTML and template files for CSS class names to offer intelligent completions based on detected values.
Our investigation revealed that the extension was silently crawling these files without any of them being opened or interacted with whatsoever. It parsed their contents and attempted to fetch styles from each URL it found — though this behavior does not appear to be documented, based on our cursory review.
Considering our previously shared project context, due to the way the sites are configured — with aggressive redirects to additional domains owned by the attacker — this effectively triggered an endless loop.
One would expect some kind of throttling mechanism to prevent this. An internal mechanism for detecting such extreme traffic would be beneficial, and should really be implemented in VS Code directly, so that extensions aren't prone to this kind of behavior, whether accidental or otherwise.
Highlighting the Risk
To put this in perspective and illustrate the significant threat this represents — albeit under an exceptionally particular set of circumstances — consider the following:
In our investigation, we observed that the extension:
<link rel="stylesheet">tags.Given that this extension has approximately 8.9 MILLION users according to the Visual Studio Marketplace statistics, we can infer the following based on our network logs and the observed connection rate:
Impact Metrics
For added emphasis, while testing to confirm the extension to be the source of this extreme traffic, and reloading the VS Code UI multiple times (which seems to trigger these bursts), the sheer velocity and magnitude of the requests actually crashed Little Snitch. For a well-regarded commercial firewall application to be overwhelmed in this manner is deeply concerning.
As a final note: Our initial investigation into the actors responsible for these types of attacks (the poached domains and referral scams) has already uncovered approximately 50 additional clones they've deployed — all packaging the same shady Thai casino referral scams, proliferated through stolen SEO.
If there is any interest in further clarification, or a more detailed investigation, we would be happy to help.
This report was submitted by Blockmage Ltd as part of our ongoing efforts to improve cybersecurity awareness across the ecosystem.
The text was updated successfully, but these errors were encountered: