Loading story…
Researchers reported a Visual Studio Code Workspace Trust and Restricted Mode bypass in which a malicious repository can use a crafted command: link to invoke the internal workbench.extensions.installExtension command. If a developer Ctrl-clicks the link in VS Code’s raw source editor, the chain can install a local malicious .vsix package, activate it immediately, and persist across subsequent VS Code launches; the reported issue is that local VSIX packages are accepted without signature or publisher validation.
A malicious extension can execute JavaScript or TypeScript with the logged-in user’s privileges, putting developer files, credentials, and software-delivery infrastructure at risk. Organizations should keep Workspace Trust enabled, instruct developers not to open links in unfamiliar repositories, review installed extensions, and centrally restrict extension installation where possible. Disabling editor link detection with "editor.links": false is a temporary mitigation while command-link handling and extension-install controls are assessed.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Remedio researchers reported that a crafted `command:` link in a malicious Visual Studio Code project can invoke `workbench.extensions.installExtension` to install a local malicious VSIX package. The extension can activate immediately and persist across later VS Code sessions, potentially running with the logged-in user's permissions despite the workspace being untrusted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security flaw has been identified in several popular AI-powered integrated development environments (IDEs) forked from Visual Studio Code, including Cursor, Windsurf, and Google Antigravity. These IDEs, which collectively serve millions of developers, were found to recommend extensions that do not exist in their supported OpenVSX marketplace. Because these extensions' namespaces were unclaimed, attackers could register them and upload malicious packages, which would then be presented as official recommendations to users. Security researchers demonstrated the risk by claiming these namespaces and uploading harmless placeholder extensions, which were still installed by over 1,000 developers, highlighting the high level of trust placed in automated extension suggestions. The vulnerability arises from inherited configuration files that point to Microsoft's extension marketplace, which these forks cannot legally use, leading to reliance on OpenVSX. Both file-based and software-based recommendations can trigger the installation prompt for these non-existent extensions, such as when opening an `azure-pipelines.yaml` file or detecting PostgreSQL on a system. The incident underscores a significant supply chain risk, as malicious actors could exploit this gap to distribute harmful code, potentially resulting in the theft of credentials, secrets, or source code. Vendor responses varied, with some IDEs addressing the issue promptly after disclosure, while others were slower to react.
Jun 29, 2026
Angular disclosed a high-severity arbitrary code execution flaw in the VS Code Angular Language Service extension (`Angular.ng-template`) that allowed a malicious repository to run code on a developer’s machine when the folder was opened in VS Code. The issue, tracked as **`CVE-2026-49241`**, affected versions prior to **`21.2.4`** and stemmed from the extension reading a workspace-configured `typescript.tsdk` path from `.vscode/settings.json` without honoring VS Code Workspace Trust or requiring user approval. That path was then passed to the background Node.js language server, which loaded `tsserverlibrary.js` from an attacker-controlled location, creating a zero-click path to host compromise and effectively bypassing VS Code Restricted Mode. Angular fixed the vulnerability in version **`21.2.4`** through two hardening changes: blocking workspace-level TypeScript SDK loading in untrusted workspaces and requiring explicit confirmation before loading a workspace-level SDK in trusted ones, with approval stored locally in secure workspace state. A second change disables the language server and related command registration until workspace trust is granted, preventing silent execution in restricted environments. The vulnerability was reported by **CodeMender from Google DeepMind** and is listed with a **CVSS 4.0 score of 8.7** as remotely exploitable.
Jun 29, 2026
Security researchers reported **malicious Visual Studio Code extensions** being used as a software supply-chain vector to compromise developer workstations. One campaign impersonated a viral AI coding assistant (“**ClawdBot**”) via a fake extension (“ClawdBot Agent”) that appeared legitimate and even functioned as an AI assistant by integrating real APIs (e.g., OpenAI/Anthropic/Google), while **silently dropping malware on Windows at VS Code startup**. The observed payload delivery used camouflage filenames such as `Lightshot.exe` (and references to `Lightshot.dll`) and an Electron-style bundle name `Code.exe`, indicating an effort to blend into common developer tooling and evolve the dropper over time. A separate finding described an **Open VSX** extension masquerading as a popular **Angular Language Service** for VS Code, which bundled legitimate dependencies (e.g., `@angular/language-service` and `typescript`) alongside a **malicious loader** that activates when users open HTML or TypeScript files (`onLanguage:html`, `onLanguage:typescript`). The loader decrypts an embedded payload using **AES-256-CBC** (Node.js `crypto`), with a hardcoded IV and a large hex-encoded ciphertext, then delays and executes the decrypted code—behavior consistent with staged malware delivery and potential worm-like propagation through widely installed editor extensions.
Jun 29, 2026