Injected Code in Aqua Trivy VS Code Extension Invoked Local AI Agents
Summary
Socket reports that OpenVSX versions 1.8.12 and 1.8.13 of Aqua’s Trivy VS Code extension injected code that launched local AI assistants for reconnaissance and attempted exfiltration. No successful exfiltration is confirmed; the affected releases were removed.
Key points
- Socket found injected code in OpenVSX versions 1.8.12 and 1.8.13, published on February 27 and 28, 2026; the code was absent from the corresponding public GitHub source and tagged releases.
- The code ran during workspace activation and silently spawned Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI with permissive, unattended execution options.
- Version 1.8.12 used a broad reconnaissance prompt that directed agents to collect sensitive information and send findings through available reporting channels.
- Version 1.8.13 directed agents to write findings to REPORT.MD and, if the GitHub CLI was authenticated, create a repository named posture-report-trivy and push the report.
- Socket reported no confirmed successful exfiltration and found no public posture-report-trivy repositories at the time; impact depended on local AI tools and, for the second release, an authenticated GitHub CLI.
- The affected releases were removed from OpenVSX after the publisher account holder revoked the publishing token. Recommended checks include reviewing extension history, AI and shell activity, GitHub activity, and rotating potentially exposed credentials.
Article Details
- Attack Vectors
- Malicious code was injected into Aqua Trivy VS Code extension versions 1.8.12 and 1.8.13 published to OpenVSX; the code was absent from the corresponding public GitHub repository and tagged releases.
- When a workspace was opened, the extension silently spawned installed AI coding assistants with permissive flags, directing them to inspect local systems and sensitive data.
- Version 1.8.13 instructed an AI assistant to write findings to REPORT.MD and use the authenticated GitHub CLI to create and push to a repository named posture-report-trivy. The article reports no confirmed successful exfiltration.
- Defensive Notes
- Uninstall affected versions 1.8.12 and 1.8.13 and verify extension installation history.
- Check for unexpected REPORT.MD files, posture-report-trivy repositories, related GitHub activity, and shell or AI-agent logs showing the described commands.
- Rotate credentials and tokens that may have been accessible during the exposure window, and audit local AI-agent and shell activity.
MITRE ATT&CK
T1005 · Data from Local SystemThe prompts instructed AI assistants to collect local system information, credentials, tokens, and other sensitive data.T1059 · Command and Scripting InterpreterThe injected extension code used child_process.spawn with shell execution to launch local AI coding CLI commands.T1074.001 · Local Data StagingVersion 1.8.13 instructed the assistant to stage collected findings in a local REPORT.MD file.T1083 · File and Directory DiscoveryThe prompts directed AI assistants to inspect the local filesystem and search for sensitive information and authentication material.T1195.002 · Compromise Software Supply ChainMalicious code was added to versions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension distributed through OpenVSX.T1518 · Software DiscoveryThe version 1.8.13 prompt directed an AI assistant to identify installed tools, MCP servers, and development programs.T1552.001 · Credentials In FilesThe version 1.8.13 prompt specifically directed the assistant to identify authentication sessions and tokens, including material stored on the local filesystem.T1567.001 · Exfiltration to Code RepositoryVersion 1.8.13 instructed the assistant to use the authenticated GitHub CLI to create posture-report-trivy and push REPORT.MD; successful exfiltration was not confirmed.
Vendors
Products
Aqua Trivy VS Code extensionVersions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension published to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissiveClaudeVS Code extension published to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissive modes to perform broad system reconnaissanceCodexextension published to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissive modes to perform broad system reconnaissance andGeminipublished to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissive modes to perform broad system reconnaissance and attemptedGitHub CLI[GitHub CLI Activity ] Suspicious gh usage indicating exfiltration attempts – examples to check: “gh auth token”, “gh repo create”, “gh repo push” (and “gh repo clone”)GitHub Copilot CLIto OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissive modes to perform broad system reconnaissance and attempted exfiltration.Kiro CLIinjected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissive modes to perform broad system reconnaissance and attempted exfiltration.OpenVSXVersions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension published to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissiveTrivyVersions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension published to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissiveVS CodeVersions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension published to OpenVSX contained injected code that launched local AI coding assistants (Claude, Codex, Gemini, GitHub Copilot CLI, Kiro CLI) in permissive