Security firm Koi Security disclosed that two VSCode Marketplace extensions marketed as AI coding assistants, ‘ChatGPT – 中文版’ and ‘ChatMoss (CodeMoss)’, secretly captured developers’ open files and source-code edits and sent them, Base64-encoded, to a server located in China. Combined, the two extensions had been installed roughly 1.5 million times and remained live on Microsoft’s marketplace as of the report. Researchers found both extensions shared identical malicious infrastructure despite being listed under different publisher names.