blog.palantir.comarticlePalantir
Palantir's InfoSec team describes how they manage VS Code extensions at scale: an osquery-based fleet inventory, an internal static-analysis tool (network/shell calls, secrets, obfuscation, npm audit), and an allowlist in a GitHub repo enforced through VS Code's `extensions.allowed` enterprise setting. Changes flow through pull-request review, CircleCI publishes to Artifactory, and Excavator generates Jamf and Group Policy configs. It also covers disabling extension telemetry and a pre-enforcement impact-assessment script, with lessons on developer buy-in.
TL;DR Palantir's policy-as-code program for allowlisting VS Code extensions, with in-house static analysis and Jamf/GPO enforcement.
Organisations named here
- Excavator
- Palantir
Technologies named here
- Visual Studio Code extensions and marketplace
- Prettier extension
- Dracula theme extension
- CircleCI - publishes allowlist results to Artifactory
- VS Code
- GitHub
- JFrog Artifactory
- npm
- osquery
- Jamf
- Aqua Security
- Check Point
- Koi Security
Techniques named here
- Allowlist-based extension management as code
- Static analysis of extensions for risky behaviors
- Fleet inventory of installed extensions via osquery
- Policy as code with pull-request-based review
Threat actors named here
- Fake Prettier extension impersonation
Related in DevSecOps
jfrog.comarticleJFrog: The Governance Gap Between Your Policy and Your Pipeline
stepsecurity.ioarticleDev Machine Guard Now Supports Windows - StepSecurity
socket.devwriteupSocket: TanStack npm Packages Compromised
securitylab.github.comadvisory