Open VSX Registry

Information about the Open VSX Registry

SleepyDuck Malware Evolves with Ethereum C2 Resilience

Nov 4, 2025

—

by

Elles De Yeager

in Threat Actors

A new sophisticated remote access trojan, dubbed “SleepyDuck,” has been discovered in the Open VSX registry, a marketplace for IDE extensions. Initially published as a benign extension on October 31, 2025, it was updated on November 1, 2025, to include malicious capabilities and has since garnered over 14,000 downloads.