[BUG] Shai-Hulud onboard

[saschamonville-a11y]

Describe the bug.

I got infected with Shai-Hulud today, assumingly through this extension.

Expected behavior

See https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24 for reference.

Screenshots

How to Reproduce

1. have it installed

🖥️ Device Information [optional]

• Operating System (OS):
• Browser:
• Browser Version:

👀 Have you checked for similar open issues?

• I checked and didn't find similar issue

🏢 Have you read the Contributing Guidelines?

• I have read the Contributing Guidelines

Are you willing to work on this issue ?

No, someone else can work on it

[github-actions]

Welcome to AsyncAPI. Thanks a lot for reporting your first issue. Please check out our contributors guide and the instructions about a basic recommended setup useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.

[ivangsa]

Hi @saschamonville-a11y

thanks for reporting this,

Can you help us reporting which channel you got this extension instaled from?

PS:
until is finally published in asyncapi blog you can follow the postmortem here https://deploy-preview-4640--asyncapi-website.netlify.app/blog/shai-hulud-postmortem

[alainkaiser]

@saschamonville-a11y Thanks for reporting this. I was also able to trace down to this extension.

[derberg]

@alainkaiser did you install it through https://open-vsx.org/extension/asyncapi/asyncapi-preview?

[nathanvogel]

I was likely also infected through this extension. My infected machine has ~/.cursor/extensions/asyncapi.asyncapi-preview-1.0.1-universal/dist/node_modules. I installed it through the built-in Cursor store if I recall correctly, which redirects to https://open-vsx.org/extension/asyncapi/asyncapi-preview.

Here's a screenshot of what I see currently:

• The Cursor GUI is the Windows host system running Cursor.
• The terminal is the mounted filesystem of the infected Linux machine.

This bumped version number seems highly suspicious.

[alainkaiser]

@derberg good question, can't really tell you anymore where I am having it from, was installed for some time. I expect that an update of the extension triggered the entire process...Otherwise I can't really explain it to me. Def. had it installed on VS-Code and also Cursor I think (maybe ported over automatically).
Cleaned up the entire machine since - So I can't really give you more details.

[saschamonville-a11y]

Hey guys, sorry for the brief issue and being unresponsive. I was quite in a hurry the last days.

I once installed the extension through vscode built-in store and later migrated to cursor.
Both IDEs were running at that time, so I'm not sure which the exact source was. Anyway, while cleaning up I was a little panicked and deleted most of suspicious files folders (like all node_modules) right away.
So I didn't had that much to investigate after cooling down.
I killed truffle hog immediately and couldn't find any evidence of exported data.
Somehow it managed to append some stuff to my shell rc file, but I did not find any additional suspicious script in package.json's I did not delete.

[saschamonville-a11y]

I got my system cleaned and wrote some little scripts I use as cron to keep an eye on that thing, but this might be closed from my side