Can You Trust Your VSCode Extensions?

aquasec.comsite

Impersonate popular VSCode extensions and trick unknowing developers into downloading them.

from

CI/CD Attacks

added

2026-10-10

likes

0

similar

1. ▲

   Deep dive into Visual Studio Code extension security vulnerabilities snyk.io

   VS Code extensions have vulnerabilities (command injection, path traversal, zip slip) that can compromise developer machines.

   site topic programming link ↗
   site
2. ▲

   Deploy VS Code extensions with vsce github.com

   tool link ↗
   
3. ▲

   gencay/vscode-chatgpt github.com

   VSCode extension.

   tool topic ai link ↗
   tool
4. ▲

   StarJacking – Making Your New Open Source Package Popular in a Snap checkmarx.com

   StarJacking is a technique where attackers make malicious open-source packages appear popular.

   site topic programming link ↗
   
5. ▲

   Awesome Browser Extensions github.com

   site link ↗
   site
6. ▲

   Can you trust ChatGPT's package recommendations? vulcan.io

   Exploit generative AI platforms' tendency to generate non-existent coding libraries to execute Dependecy Confusion.

   site topic aitopic programming link ↗
   

CI/CD Attacks › Techniques > Initial Code Execution: “Impersonate popular VSCode extensions and trick unknowing developers into downloading them.”