VS Code Marketplace

Visual Studio Code extensions

The Visual Studio Code Marketplace is the largest IDE extension source we track — about 150,000 packages — and the most-connected: extensions run with your shell, your filesystem, and your git credentials in scope. Supply-chain campaigns here are not theoretical. The GlassWorm worm self-propagated through VS Code and OpenVSX packages using invisible-Unicode code, and the Count Dooku campaign re-published legitimate extensions with a beaconing payload appended after the source map. We scan every VSIX we can obtain for those exact patterns plus secrets, obfuscation, and risky activation hooks.

• –Activation hooks that fetch and execute remote code on first run
• –Stolen npm/GitHub/OpenVSX tokens committed inside bundled dependencies
• –Typosquats and re-published forks of popular extensions with appended payloads

Security intelligence powered by Risky Plugins