Independent security researcher and systems engineer based in Berlin. Author of UNK_DeadDrop and unk-scanner. I write about static AST analysis, software supply-chain security, and low-level runtime internals. Currently open to full-time roles in security research, static analysis tooling, or systems engineering.
Markdown supported · ⌘↵ to post
Damiano Bianda
One detection angle worth adding: ELECTRON_RUN_AS_NODE is a documented Electron feature, so any editor process launched with that variable set is a cheap, high-signal hunt. It also survives the masquerade. The publisher name and extension ID can change per campaign, the env var cannot, because the technique breaks without it. The point about preserving the VSIX together with the workspace settings is underrated too: the hash identifies the archive, but the googleUpdateSupport.* configuration is what tells you where a given installation was actually sending data.