Executive Summary
A malicious extension named CodeAIAssistant (publisher Luxiel Security) has been identified on the Visual Studio Code Marketplace. Despite posing as a 2.9 KB AI-powered coding tool, the package contains no functional AI code and instead serves as a delivery vehicle for arbitrary process execution. The extension is part of a recurring campaign linked to the 'Luxiel' identity first observed in August 2026.
The threat utilizes a novel technique by abusing the `vscode:mcp/install` URL handler. By setting the install type to 'streamable', the malware bypasses the standard VS Code review boundary, hiding the command and arguments from the user's installation preview dialog. Once installed, it persistently executes payloads on every IDE launch through both MCP server contributions and direct Node.js `child_process.spawn` calls.
This campaign highlights a significant shift in supply chain attacks targeting developers. By leveraging documented IDE features like MCP, attackers can achieve code execution without triggering typical permission warnings or network-based detection, making it an effective primitive for future deployment of downloaders, info-stealers, or reverse shells.