Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

Cybersecurity researchers have uncovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of extensions that have been deleted, potentially enabling new, malicious extensions to masquerade as familiar ones. The discovery, by software supply chain security outfit ReversingLabs, followed the identification of a malicious extension named "ahbanC[.]shiba" that functioned similarly to two other extensions flagged earlier this March, "ahban[.]shiba" and "ahban[.]cychelloworld".

All three appear to download a PowerShell payload from an external server and encrypt files on a victim’s Windows desktop, with the actor demanding a Shiba Inu token via an unspecified wallet.

Visual Studio Code documentation states that the <name> field must be unique to the Marketplace and all be lowercase with no spaces, yet the researchers noted that the new extension’s name was nearly identical to one of the others, highlighting that mere publisher-name differences can distinguish extensions, while the name itself remains the same.

Lucija Valentić, a security researcher involved, warned that once an extension is removed, its name can be reused by anyone, a risk not mirrored by PyPI according to the report.