🧰 VS Code

The items that name it 88

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeupas classification.technologies2026-10-31
• Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus
  articleas affected products2026-10-30
• Malicious Claude Code extension on Cursor planted SSH backdoors
  articleas classification.technologies2026-10-30
• Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
  articleas affected products2026-10-30It is written here as VS Code (malicious extensions; PolinRider can run when a project is opened).

  malicious extensions; PolinRider can run when a project is opened

• Backdoors in official Claude Code extensions
  threadas classification.technologies2026-10-30
• Shubham Mishra 🐐 (@shubh6200) on X
  threadas classification.technologies2026-10-30
• Trojanized Claude Code Extension Plants an SSH Backdoor
  writeupas classification.technologies2026-10-30
• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
  writeupas classification.technologies2026-10-30
• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
  writeupas classification.technologies2026-10-30
• The OpenSourceMalware Show #26
  talkas affected products2026-10-21It is written here as VS Code (opening an infected repo runs the credential stealer via the tasks file).

  opening an infected repo runs the credential stealer via the tasks file

• Stolen Ethereum laundering resumes as 25,700 ETH flow into Tornado Cash mixer
  articleas classification.technologies2026-10-20
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.technologies2026-10-16
• StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines
  articleas affected products2026-10-08

  Editor targeted in the Miasma worm's credential-harvesting payload when a developer opens the affected repository.

• Top MCP security resources — October 2026
  articleas classification.technologies2026-10-08
• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeupas classification.technologies2026-10-08
• How to Investigate a GitHub Repo's Real History
  writeupas affected products2026-10-06It is written here as VS Code (.vscode/tasks.json with runOn folderOpen used as trigger).

  .vscode/tasks.json with runOn folderOpen used as trigger

• Introducing Socket Scanning for VS Code Marketplace Extensions
  articleas classification.technologies2026-10-06
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeupas classification.technologies2026-10-02
• PolinRider is A/B Testing its Way Past Your Detections
  writeupas affected products2026-09-26It is written here as VS Code (Visual Studio Code).

  tasks.json folderOpen autorun tasks abused to execute payloads; Workspace Trust prompt and 'task.allowAutomaticTasks' setting relevant to exploitation.

• graygnatconsole/mcp-audit-tool
  repoas classification.technologies2026-09-26
• The OpenSourceMalware Show #22
  talkas classification.technologies2026-09-25
• Top 10 attacks on Claude Code and what each one actually broke
  writeupas affected products2026-09-23

  Affected by Miasma worm's config injection payload.

• Auditing in the age of (good enough) AI
  writeupas classification.technologies2026-09-18
• PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  articleas classification.technologies2026-09-17
• The OpenSourceMalware Show #21
  talkas classification.technologies2026-09-17
• Patch Tuesday - September 2026
  advisoryas classification.technologies2026-09-08
• The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development
  articleas affected products2026-09-02
• The OpenSourceMalware Show #19
  talkas classification.technologies2026-08-28
• Customer Zero: Implementing Package Firewall at Endor Labs | Blog | Endor Labs
  articleas classification.technologies2026-08-25
• NPM Isn't Prepared For North Korean PolinRider Attack
  writeupas classification.technologies2026-08-25
• 77 "Evil Twin" Open VSX Extensions
  articleas classification.technologies2026-08-08
• keyv and cacheable npm Package Hijacked in Supply Chain Attack
  writeupas classification.technologies2026-08-04
• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeupas classification.technologies2026-08-04
• Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
  articleas classification.technologies2026-08-03
• Before the first prompt: Code execution paths in trusted coding-agent projects
  writeupas classification.technologies2026-08-03
• The OpenSourceMalware Show #15
  talkas classification.technologies2026-07-31
• Semgrep Rules (0xdea)
  repoas classification.technologies2026-07-31
• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas classification.technologies2026-07-31
• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeupas classification.technologies2026-07-30
• Security notice and deprecation: standalone circleci-mcp-server
  advisoryas tools2026-07-20

  AI tool that connects to the CircleCI MCP server via MCP config file

• OpenSourceMalware Blog
  articleas affected products2026-07-18

  Extension cooldowns issued; tasks.json and task automation weaponized by Lazarus Group and Mini Shai-Hulud; malicious VS Code task configurations hit at least 21 small OSS maintainers.

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas affected products2026-07-17

  Tasks feature abused by TasksJacker to compromise GitHub users

• The OpenSourceMalware Show #13
  talkas classification.technologies2026-07-16
• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas affected products2026-07-16

  AI coding tool exploited by Miasma to trigger credential harvester when repository opened

• The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution
  writeupas affected products2026-07-15It is written here as vscode://.
• awesome-ai-security-tools
  repoas affected products2026-07-11

  IDE/agent host covered by MCP Defender

• The OpenSourceMalware Show #12
  talkas classification.technologies2026-07-09
• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas affected products2026-07-08It is written here as VS Code (.vscode/tasks.json).

  Abused via runOn: folderOpen trigger to curl-pipe a shell command when a project is opened.

• Socket: PolinRider
  writeupas classification.technologies2026-07-02
• MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
  writeupas classification.technologies2026-06-26
• The OpenSourceMalware Show #10
  talkas classification.technologies2026-06-25
• Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions
  articleas classification.technologies2026-06-18
• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas classification.technologies2026-06-18
• Multiple JetBrains IDE plugins caught stealing AI keys
  writeupas affected products2026-06-16

  Mentioned as target of separate ongoing GlassWorm supply chain campaign.

• Socket: GlassWASM
  writeupas classification.technologies2026-06-16
• Pipelock
  repoas classification.technologies2026-06-14
• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-12
• The OpenSourceMalware Show #8
  talkas classification.technologies2026-06-11
• The Pros and Cons of NPM v12's Security Improvements
  articleas affected products2026-06-10It is written here as VSCode.

  global task.allowAutomaticTasks setting enabled by default, allowing malicious tasks files to auto-run when victims opened source code containing them

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas affected products2026-06-09

  Triggered via .vscode/tasks.json on folder open to execute payload

• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas classification.technologies2026-06-09
• Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-08
• Why EDR and proxy won’t save you from supply chain malware
  articleas affected products2026-06-02

  Manages its own extension downloads, bypassing proxy; example given of compromised extension installed from personal machine

• Nx Console VS Code Extension Compromised
  writeupas classification.technologies2026-06-02
• Dev Machine Guard Now Scans Extensions Across Every Modern IDE
  articleas classification.technologies2026-06-02
• Orca Security: Securing Shadow AI: How to Detect Unapproved LLMs in Your Cloud
  articleas affected products2026-06-01

  Extension autocompletes code by sending snippets to external API

• What MDM can't protect on developer machines (and what to do about it)
  articleas affected products2026-05-28It is written here as VS Code (Nx Console extension).

  Verified publisher extension with 2.2 million installs, compromised for 18 minutes on the Visual Studio Marketplace

• Open Source Malware Podcast — episodes
  otheras affected products2026-05-22

  Cooldowns introduced; also GitHub popped by malicious VS Code extension

• The Wild West of VS Code extensions and how a poisoned extension breached GitHub
  articleas affected products2026-05-20

  Ships with auto-update on by default for extensions; contains extensionsWorkbenchService.ts logic (12-hour fallback timer, 1-hour on Insiders with pending product update, startup check, event-based triggers, eventuallyAutoUpdateExtensions via gallery-sync with 1-second throttled delayer) and the ext

• GitHub breached via a malicious VS Code extension: why developer devices are the real target
  articleas classification.technologies2026-05-20
• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeupas classification.technologies2026-05-19
• Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages
  articleas classification.technologies2026-05-19
• VSCode Lifecycle Script Malware
  writeupas affected products2026-05-16

  default changed to off in version 1.109, January 2026

• GitHub Secret Scanning MCP Server
  articleas classification.technologies2026-05-11
• GitHub Dependency Scanning MCP Server
  toolas classification.technologies2026-05-11
• Pantheon-Security/medusa
  repoas affected products2026-05-10It is written here as VS Code (.vscode/settings.json, *.code-workspace).

  .vscode/settings.json, *.code-workspace

• Socket: 73 Open VSX Sleeper Extensions Linked to GlassWorm
  writeupas classification.technologies2026-05-06
• MCP Audit Extension
  repoas classification.technologies2026-05-06
• Cooldowns.dev
  articleas tools2026-05-06

  IDE; extensions.autoUpdateDelay setting (configurable since 1.125) delays automatic extension updates.

• Palantir
  articleas classification.technologies2026-05-05
• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas classification.technologies2025-12-03
• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas classification.technologies
• Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
  articleas classification.technologies
• OWASP Agentic Skills Top 10 (AST10)
  repoas affected products
• OWASP Agentic Skills Top 10
  paperas affected products

  package.json skill format.

• sage — Agent Detection & Response (ADR) for AI coding agents
  repoas affected products
• Dev Machine Guard Now Supports Linux - StepSecurity
  articleas classification.technologies
• Dev Machine Guard Now Supports Windows - StepSecurity
  articleas affected products

  IDE with extensions auto-updating from the VS Code Marketplace

In every workspace you can read 109