AI
Why Developer Machines Are High-Value Targets
Compromising a developer is different from compromising HR. Developers have access to source code, infrastructure credentials, and CI/CD pipelines. Their IDEs hold API keys and secrets in plaintext. Trusted development tools often bypass security controls entirely. Many EDR and SIEM deployments monitor executable binaries but ignore plugins installed inside an IDE, even though a plugin is executable code running with the same privileges as the user who launched the editor.
The VS Code Extension Model Has No Real Guardrails
VS Code has 70% market share among developers. Anyone can publish an extension in under 10 minutes. Extensions auto-update by default, so a publisher can ship a clean extension, build installs over months, then push malicious code to every existing user overnight. Extensions are not sandboxed. They run with full user privileges. If the user is an administrator, so is every extension. The package format is a zip containing plain JavaScript with no required obfuscation review.
Dependency Tricks and Persistent Backdoors
Over 90% of malicious extensions Silva analyzed used the star activation event, which fires as soon as VS Code can run code. Extensions can declare other extensions as dependencies. When you uninstall the parent, extension-pack dependencies get removed, but extension-dependency entries stay installed. An attacker ships a clean-looking extension with a malicious extension dependency. The victim uninstalls the obvious package and has no idea the payload is still running. Silva’s CMake typo-squat used this pattern with a separate info-stealing dependency.
Three PoCs That All Passed in Five Minutes
Silva published three extensions to test Microsoft’s scanning. The first hid a payload as Base64 inside a PNG, decoded via regex, and called home on install. It passed. The second was a typo-squat of CMake that carried the first as a silent dependency. It passed. The third was the same info-stealer with zero obfuscation, pasted directly into the JavaScript file. It also passed in under five minutes. A random developer in Poland running his own detection tool emailed Silva the same night he published the plaintext version. Microsoft took almost a month to remove it.
What Real Malware Does After Install
Silva’s team reported 17 extensions over 12 months. The dominant payload pattern was data theft via Discord webhooks, which accounted for over 60-70% of cases. Extensions monitored the active editor and exfiltrated the full file content on every save, delete, or open. Others downloaded a PS1 or shell script from a hardcoded URL and executed it. One extension Silva found had over a million installs. Two or three commercial EDRs tested against the malicious extensions raised no alerts when the extensions ran.
What Defenders Can Actually Do
Microsoft recommends checking ratings, Q&A, and repository links, but Silva showed all of these can be spoofed. Publisher verification only means the person owns a domain that has existed six months. The only control that reliably works is an organization-wide extension allowlist. VS Code now supports this, though it requires enforcing it via policy. Blocking Discord and Telegram webhook endpoints removes the most common exfiltration channel but does not stop extensions that download and execute remote scripts. SIEM rules detecting outbound connections immediately after an extension installs catch a useful behavioral pattern.
Q&A
How do you monitor for removed extensions to know if developers installed them before takedown? The only current method is polling the VS Code Marketplace GitHub page for updates to the removal log, then checking EDR logs for extension install events — though tested EDRs did not record those events. ▶ 25:52
Are unpublished extensions still accessible? Yes. Extensions flagged as unpublished are retrievable via the Marketplace API but do not appear in search results. Attackers use this to stage payloads before release or to hide active extensions. ▶ 41:01
Is Open VSX worse? Open VSX, used by Cursor and other forks, has fewer protections than the VS Code Marketplace, which already has few. ▶ 38:37
Notable Quotes
pretty much anyone can publish extensions. It’s we’ll we’ll see it also a bit later, but yeah, it’s pretty much open to anyone. So, you can just you can like go from nothing to unpublished extension in like 10 minutes and there’s not many safeguards around the whole of publishing the extensions. Raphael Silva · ▶ 4:40
one for the random Polish guy, zero for Microsoft. Raphael Silva · ▶ 20:40
this policy would cause a revolt amongst developers. Raphael Silva · ▶ 34:52
that’s pretty much the same as the VS code but worse because they have less protections in the VS code marketplace which has already few protections. Raphael Silva · ▶ 38:37
Key Takeaways
- VS Code extensions run unsandboxed with full user privileges and auto-update silently by default.
- Extension dependencies persist after the parent is uninstalled, leaving hidden code running in the IDE.
- Three plaintext and obfuscated malicious extensions all passed Microsoft’s marketplace review in under five minutes.
- Discord webhooks carry 60-70% of observed data exfiltration from malicious extensions.
- An organization-wide extension allowlist is the only control that reliably blocks this attack class.
About the Speaker(s)
Raphael Silva is a Security Researcher at Checkmarx with four and a half years focused on web research and, more recently, supply chain security. He has presented at RootedCon, OWASP Global AppSec, and OWASP Local Chapters.