12 Malicious Extensions in VSCode Marketplace Steal Source Code and Exfiltrate Login Credentials

The VSCode extension marketplace has been identified as a critical vulnerability in the software supply chain, with 12 malicious extensions detected in the Microsoft VSCode Marketplace and OpenVSX, four of which remain active. The extensions are capable of stealing source code, exfiltrating credentials, establishing remote backdoors, and conducting surveillance of developer environments, highlighting a growing attack vector targeting development teams at scale.

According to HelixGuard Team, these extensions have accumulated over 613 million total downloads, underscoring the breadth of exposure, as the ecosystem expands with AI-powered coding assistants and a burgeoning VSCode user base. Four extensions that are still active include Christine-devops1234[.]scraper, Kodease[.]fyp-23-s2-08, GuyNachshon.cxcx123, and sahil92552[.]CBE-456, which transmit data to attacker-controlled infrastructure or perform installation detection.

Additional extensions mentioned provide deeper capabilities, such as persistent connections to attacker-owned AWS infrastructure enabling remote code execution, while others send data to command-and-control servers, raising immediate risks for developers who may inadvertently install them. The piece urges regular audits of installed extensions and tight governance to curb supply chain risks in IDE plugins. October 30, 2025