🧰 VS Code extensions

The items that name it 8

• vet (SafeDep)
  repoas affected products2026-09-07

  Scanned via vet --vsx flag

• Customer Zero: Implementing Package Firewall at Endor Labs | Blog | Endor Labs
  articleas affected products2026-08-25

  auto-update by default; example Go extension fetches vscgo, gopls, dlv directly from Go module proxy rather than the marketplace

• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06It is written here as VSCode extensions.

  Poisoned extension compromised a GitHub employee's credentials, leading to unauthorized access to GitHub's internal repositories.

• DataDog/guarddog
  repoas affected products2026-07-11It is written here as VSCode Extensions (marketplace.visualstudio.com).

  marketplace.visualstudio.com

• What nearly 10,000 developer environments reveal about agentic development risk
  articleas affected products2026-06-23

  AI coding environment; developers found running multiple such environments simultaneously

• Secret Scanning Dev Workstations with bagel + Fleet
  writeupas affected products2026-06-04

  Extension ecosystem cited as expanding workstation attack surface.

• Miasma: Supply Chain Attack Targeting RedHat npm Packages
  writeupas tools2026-06-01It is written here as VSCode extensions.

  Flagged as something organizations should audit for signs of compromise

• JFrog: The Governance Gap Between Your Policy and Your Pipeline
  articleas affected products2026-05-21

  Seven extensions compromised in the GlassWorm attack, harvesting credentials and deploying a RAT across ~35,800 installs.