🧰 Visual Studio Code

The items that name it 18

• Malicious Claude Code extension on Cursor planted SSH backdoors
  articleas affected products2026-10-30It is written here as Visual Studio Code (Microsoft).

  Microsoft

• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas affected products2026-10-16It is written here as Visual Studio Code (folderOpen tasks in trusted workspaces with task.allowAutomaticTasks on or Allow clicked).

  folderOpen tasks in trusted workspaces with task.allowAutomaticTasks on or Allow clicked

• The OpenSourceMalware Show #22
  talkas affected products2026-09-25It is written here as Visual Studio Code (tasks autorun feature).

  VS Code's task auto-run function, combined with a fake font file and obfuscated JavaScript, is used to get PolinRider/Contagious Interview malware onto developer machines when a repo is opened and trusted; noted that ~76% of developers have VS Code installed.

• Socket: Open VSX Unblocks Extension IDs Used in Malware Campaign
  articleas classification.technologies2026-08-24
• Before the first prompt: Code execution paths in trusted coding-agent projects
  writeupas affected products2026-08-03It is written here as Visual Studio Code (project tasks run after trust in the Contagious Interview campaign).

  project tasks run after trust in the Contagious Interview campaign

• Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions
  articleas affected products2026-06-18

  Code editor whose extension marketplace was used to distribute the malicious Nx Console extension.

• Socket: GlassWASM
  writeupas affected products2026-06-16It is written here as Visual Studio Code (and forks).

  Editors affected via Open VSX-sourced malicious extension installs, especially VSCodium, Cursor, Windsurf, Gitpod which default to Open VSX.

• The OpenSourceMalware Show #8
  talkas affected products2026-06-11It is written here as Visual Studio Code (third-party extensions, VS Code Marketplace).

  third-party extensions, VS Code Marketplace

• Nx Console VS Code Extension Compromised
  writeupas affected products2026-06-02

  extension distributed via VS Code Marketplace; over 2.2 million installations of Nx Console

• Dev Machine Guard Now Scans Extensions Across Every Modern IDE
  articleas affected products2026-06-02

  IDE extension ecosystem covered by Dev Machine Guard; affected by October 2025 publisher token leak incident

• CVE Lite CLI
  repoas affected products2026-05-31

  Case study: two direct Anthropic SDK advisories and a high-severity gulp toolchain chain found in the VS Code root lockfile.

• VSCode Lifecycle Script Malware
  writeupas classification.technologies2026-05-16
• GitHub Secret Scanning MCP Server
  articleas tools2026-05-11

  MCP-compatible IDE used with GitHub MCP server and Copilot Chat for secret scanning

• GitHub Dependency Scanning MCP Server
  toolas affected products2026-05-11It is written here as Visual Studio Code (GitHub Copilot Chat).

  GitHub Copilot Chat

• Socket: 73 Open VSX Sleeper Extensions Linked to GlassWorm
  writeupas affected products2026-05-06

  Target IDE for malicious --install-extension commands

• MCP Audit Extension
  repoas affected products2026-05-06

  Host editor for the MCP Audit extension

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas tools2025-12-03It is written here as Visual Studio Code (code.exe).

  Downloaded and used by threat actors to establish remote tunnels for C2, bypassing antivirus since it is a legitimate signed application; used in Incident 2 and Incident 3

• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
  articleas affected products

In every workspace you can read 21