Source: socket.dev
Socket has launched experimental scanning support for VS Code Marketplace extensions, covering 100,000+ extensions alongside existing Open VSX coverage. The initiative was prompted by real-world attacks, including a GitHub breach originating from a malicious update to the Nx Console VS Code extension, which led to exfiltration of approximately 3,800 internal repositories. Socket's GlassWorm investigation uncovered a cluster of malicious VS Code and Open VSX extensions disguised as color themes, some using encrypted JavaScript and a Solana dead drop to execute additional payloads. The scanning capability detects risky behaviors including unauthorized file system access, suspicious network activity, process execution, obfuscated code, and hidden functionality. The article highlights that even previously vetted extensions can be weaponized through automatic updates without developer awareness. Socket's analysis covers code, activation patterns, dependencies, and capabilities to help security teams make informed decisions about extension adoption.
