How Malicious Extensions Turn IDEs Into Attack Vectors

Summary

A Black Hills Information Security researcher demonstrates how malicious VS Code extensions can execute code and impersonate legitimate extensions, and discusses detection and prevention measures.

Key points

• The presenter describes malicious Solidity extensions that impersonated legitimate offerings; one used PowerShell to download and execute a script on Windows.
• The webcast discusses compromised extensions and malicious automatic updates as supply-chain attack paths, including a reported GitHub compromise.
• A demonstration used a native Node add-on in an extension to run shellcode, then modified local metadata to impersonate a legitimate extension and obscure its installation source.
• Potential warning signs include mismatched extension names, local VSIX installation and native .node files, although the presenter cautions that legitimate applications also use native add-ons.
• Suggested defenses include restricting local extension installation, maintaining an approved extension list and keeping a software bill of materials.
• In a separate authorized engagement, the presenter said an MCP server and Claude were used to identify sensitive files and shares after other tools were detected.

MITRE ATT&CK

People

Products

Tools

Related Articles

• Socket traces a VS Code theme cluster across marketplaces to GlassWorm-linked malwaresocket.devOpen VSX · VS Code · T1027 · T1195.002
• StepSecurity Details Tensorlake npm Malware That Steals Credentials and Can Wipe Home Directoriesstepsecurity.ioVS Code · T1027 · T1059.001 · T1195.002
• GlassWASM Malware in Trojanized Open VSX Extensions Uses Solana for C2socket.devOpen VSX · T1027 · T1059.001 · T1195.002
• Supply-Chain Malware Campaigns Target Developers and CI Systems in 2026opensourcemalware.comVS Code · T1027 · T1059.001 · T1195.002
• BeaverTail and OtterCookie Add Keylogging and Screenshot Capabilitiesblog.talosintelligence.comVS Code · T1027 · T1059.001 · T1195.002