Skip to content

Back to the catalog

Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions
socket.devarticle

Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions

Socket announced Firewall support for VS Code Marketplace and Open VSX extension installs, proxying marketplace and VSIX download traffic to block malicious extensions before install/update rather than only after-the-fact inventory. The post cites the May 2026 GitHub breach via a poisoned Nx Console 18.95.0 extension (exfiltrating ~3,800 internal repos) and repeated GlassWorm credential-stealing campaigns on Open VSX as motivating incidents. The feature is a closed-beta, agentless proxy control point covering editors like VS Code, Cursor, Windsurf, VSCodium, and Antigravity.

TL;DR Socket Firewall now proxies and blocks malicious VS Code/Open VSX extension installs at download time, citing the Nx Console supply-chain compromise and GlassWorm campaigns as motivation.
Open original ↗

Organisations named here

  • Nx Console 18.95.0

Technologies named here

  • Socket Firewall
  • Nx Console
  • VS Code Marketplace
  • Socket
  • Open VSX
  • Visual Studio Code
  • Cursor
  • Windsurf
  • VSCodium
  • Antigravity
  • VS Code

Techniques named here

  • Supply chain compromise via malicious editor extension
  • Credential theft and spread via trusted marketplaces

Threat actors named here

  • GlassWorm
  • Unnamed attackers

Related in Supply Chain