VSCode extensions Archives

Flaws in popular VSCode extensions expose developers to attacks

18Feb

By RBNo Comments

News

Flaws in popular VSCode extensions expose developers to attacks

Popular Visual Studio Code (VSCode) extensions that have been downloaded over 128 million times combined have vulnerabilities with high to critical severity ratings that might be used to remotely execute code and steal local files. The security flaws affect Microsoft Live Preview (no identification allocated), Code Runner (CVE-2025-65715), and Markdown Preview Enhanced (CVE-2025-65716, CVE-2025-65717). Ox Security's application security researchers found the vulnerabilities and have been working to make them public since June 2025. But according to the researchers, no maintenance replied. The capabilities of Microsoft's integrated development environment (IDE) can be increased with the help of VSCode extensions. They can include themes, debugging tools, language support, and addi...

Malicious crypto-stealing VSCode extensions resurface on OpenVSX

15Oct

By RBNo Comments

News

Malicious crypto-stealing VSCode extensions resurface on OpenVSX

TigerJack is a threat actor that targets developers with malicious extensions that are posted on the OpenVSX registry and Microsoft's Visual Code (VSCode) marketplace in order to steal cryptocurrency and create backdoors. Two of the extensions are still available on OpenVSX even though they were taken out of VSCode after 17,000 downloads. The same malicious code is also republished by TigerJack on the VSCode marketplace under several identities. An independent, vendor-neutral registry is offered by OpenVSX, a community-maintained open-source extension marketplace that functions as a substitute for Microsoft's platform. For well-known VSCode-compatible editors like Cursor and Windsurf that are legally or technically prohibited from using VSCode, it is also the default marketplace. Si...

Malicious VSCode extensions infect Windows with cryptominers

8Apr

By RBNo Comments

News

Malicious VSCode extensions infect Windows with cryptominers

On Microsoft's Visual Studio Code Marketplace, nine VSCode extensions masquerade as genuine development tools but infect users with the XMRig cryptominer, which mines Ethereum and Monero. The well-known code editor Microsoft VSCode lets users add extensions to increase the program's functionality. Microsoft's VSCode Marketplace, an online resource for developers to locate and install add-ons, is where developers may get these extensions. On April 4, 2025, researcher Yuval Ronen of ExtensionTotal discovered nine VSCode extensions that were posted on Microsoft's webpage. Since April 4, the extensions have already accumulated over 300,000 installs, according to the marketplace. These figures are probably exaggerated to make the extensions seem more popular and legitimate, which will...

Malicious VSCode extensions with millions of installs discovered

10Jun

By RBNo Comments

News

Malicious VSCode extensions with millions of installs discovered

Through the use of trojanized copies of the well-known "Dracula Official theme," a group of Israeli researchers investigated the security of the Visual Studio Code marketplace and were able to "infect" over 100 businesses with malicious code. After more investigation, thousands of extensions with millions of installs were discovered in the VSCode Marketplace. Microsoft Visual Studio Code (VSCode) is a source code editor that is widely used by professional software developers across the globe. Additionally, Microsoft runs the Visual Studio Code Marketplace, an add-on marketplace for the IDE that offers upgrades that increase the functionality and personalization possibilities of the program. Prior analyses have uncovered vulnerabilities in VSCode's security that permit publisher a...