Israeli Researchers Discover Malicious VSCode Extensions
Malicious VSCode extensions with millions of installs discovered 🔗
A group of Israeli researchers discovered that the Visual Studio Code Marketplace contains numerous malicious extensions, with one of their experiments successfully trojanizing a popular theme and infecting over 100 organizations. They found thousands of extensions with millions of installs that pose risks to organizations and lack stringent controls and code reviewing mechanisms. The researchers responsibly reported the malicious extensions to Microsoft, but many remain available for download. They plan to release a free tool, 'ExtensionTotal', to help developers scan for potential threats.
- Israeli researchers discovered malicious VSCode extensions with millions of installs
- Experiment successfully trojanized a popular theme and infected over 100 organizations
- Thousands of extensions with millions of installs pose risks to organizations
- Lack of stringent controls and code reviewing mechanisms on VSCode Marketplace
- Malicious extensions were responsibly reported to Microsoft, but many remain available
- Researchers plan to release a free tool, 'ExtensionTotal', to help developers scan for potential threats