Author: CyberDudeBivash
Powered by: CyberDudeBivash Brand | cyberdudebivash.com
Related:cyberbivash.blogspot.com

Published by CyberDudeBivash • Date: Oct 30, 2025 (IST)

CRITICAL VSCode Security Flaw: 12 Extensions Are Silently Stealing Your Code. Check Your Setup Now!

Live supply-chain attacks are abusing the VS Code extension ecosystem. Malicious add-ons exfiltrate source code, tokens, cookies and can drop backdoors. Audit and lock down your setup now.

Edureka (AppSec/Supply-Chain)Kaspersky Security AliExpress WW Alibaba WWCyberDudeBivash Ecosystem:Apps & Services · Threat Intel (Blogger) · CryptoBivash · News Portal · Subscribe: ThreatWire

TL;DR — Check & Clean Your VS Code Now

Live threat: At least 12 malicious VS Code extensions are being used to steal source code, secrets and open backdoors.
Context: This wave follows recent VS Code marketplace exposures and GlassWorm self-propagating attacks; marketplace security gaps remain under scrutiny.
Immediate actions (devs): Audit extensions → remove unknown publishers → rotate tokens → set ignore-scripts where possible → monitor egress.
Enterprise: Enforce allowlists, disable auto-update for extensions, isolate CI, and scan artifacts/SBOMs for tainted packages.

Why VS Code Extensions Are a Prime Target

Extensions run with your user’s privileges, access your workspace, environment variables, and network. Attackers exploit this trust—abusing name reuse, compromised publisher tokens, and transitive dependencies—to push silent updates that siphon code and secrets. Recent research shows how leaked marketplace tokens and weak vetting enable malicious updates at scale.

What Today’s “12 Extensions” Campaign Is Doing

Exfiltrating code & credentials: Packaging obfuscated JS/TS that zips project files and posts to attacker endpoints; harvesting tokens/cookies.
Persistence/backdoors: Dropping second-stage payloads, reverse shells, or RATs under developer context.
Stealth: Masquerading as popular utilities (formatters/icons), using look-alike names and recycled package names from removed projects.
Related waves: GlassWorm and other campaigns showed self-propagation and 10k+ victim counts across marketplaces.

Rapid Triage: 15-Minute Self-Check

List everything installed (CLI):code –list-extensions –show-versions > vscode-extensions.txtReview unknown publishers, sudden recent updates, or low-reputation entries.
Spot suspicious settings:
- VS Code → Settings → search “telemetry”, “proxy”, “postinstall” in settings.json and workspace settings.
- Disable: extensions.autoUpdate (temporarily during response).
Network egress: check firewall/EDR for newly seen domains right after VS Code launch or file open events.
Mac/Linux: inspect ~/.vscode/extensions; Windows: %USERPROFILE%\.vscode\extensions — look for unfamiliar directory names, recent timestamps.

Cleanup & Token Rotation

Uninstall suspects:code –uninstall-extension PUBLISHER.EXTENSION –forceThen remove their on-disk folders from .vscode/extensions.
Rotate credentials immediately: GitHub/GitLab PATs, npm tokens, cloud keys (AWS/GCP/Azure), SSH keys. Revoke OAuth app access you don’t recognize.
Browsers: clear cookies/sessions on dev machines; change SSO passwords (enable hardware-key 2FA).
Rebuild hygiene: reinstall VS Code from official channels; only re-enable trusted extensions after review.

Hardening VS Code (Users & Enterprises)

Allowlist extensions (enterprise): distribute a curated list; block unknown publishers.
Disable auto-update for extensions org-wide; approve updates after review (check publisher, changelog, diffs).
Restrict extension capabilities: run dev workloads in sandboxes/containers; no direct host secrets in env.
Monitor workspace exfil: EDR rules for zipping large directories + outbound HTTP from VS Code processes.
Educate devs: phishing and impostor publishers; verify star/download spikes and reviews quality.

Protecting CI/CD & Repos

SBOM/SCA: generate SBOMs (CycloneDX) and block builds introducing new extension-driven steps.
Ephemeral runners: no persistent home dirs; restricted egress; OIDC-based short-lived tokens.
Repo controls: require signed commits/releases; enforce 2FA; monitor for unusual PAT usage.
Incident drill: tested token rotation runbooks; alerting on novel GitHub Apps or Actions in orgs.

CyberDudeBivash Services, Apps & Ecosystem

Services (Hire Us)

Software Supply-Chain Reviews (VS Code, npm, registries)
Developer Endpoint Hardening & EDR Tuning
Incident Response: Token Rotation & Repo Remediation
Secure Build Provenance & Release Signing Programs

Explore Apps & Products Consulting & Services Subscribe: ThreatWire

Emergency Response Kit (Affiliates)

Edureka — Secure SDLC & Supply-Chain Courses
Kaspersky — Developer endpoint protection
Alibaba WW / AliExpress WW — security keys & hardware

Our Departments & Pages

FAQ

Is this only on the Microsoft Marketplace?

No. Attacks have hit both Microsoft’s Marketplace and Open VSX; worms like GlassWorm showed cross-registry spread.

What if I use Cursor or other IDEs?

VS Code-compatible ecosystems share risk; Cursor incidents and impostor extensions show similar patterns. Audit all IDEs that consume VS Code-style extensions. :contentReference[oaicite:9]{index=9}

Can I keep using extensions safely?

Yes—with strict allowlists, review, and monitoring. Treat permissionless installs as risky; disable auto-updates and review diffs for approved publishers.

Sources

“VSCode Supply Chain Compromise: 12 Malicious Extensions…” — SecurityOnline (Oct 30, 2025).
GBHackers coverage of 12 malicious VS Code extensions (Oct 30, 2025).
CyberPress: “VSCode Extensions Found Stealing Source Code…” (Oct 30, 2025).
Wiz Research — Supply chain risk & Marketplace token issues (Oct 15, 2025).
eSecurityPlanet — campaign stole code from thousands of devs (Oct 15, 2025).
ReversingLabs — malicious VS Code extensions stealing sensitive info (Apr 3, 2024).
Veracode/Koi — “GlassWorm” self-propagating extensions (Oct 20, 2025).
Fluid Attacks — GlassWorm analysis & defenses (Oct 24, 2025).

Ecosystem: cyberdudebivash.com | cyberbivash.blogspot.com | cryptobivash.code.blog | cyberdudebivash-news.blogspot.com | ThreatWire

#CyberDudeBivash #CyberBivash #VSCode #SupplyChain #GlassWorm #DevSecOps #SourceCodeTheft #ThreatWire

Cyberdudebivash