---
id: post/demiliani-com/13761
type: post
title: Be careful with Visual Studio Code extensions…
summary: "Summary withheld: an Opus review found that the machine-written summary did not match the post. Read the original post."
tier: community
language: en
tags:
  - security
  - vs code extensions
  - governance
  - developer tools
  - risk management
system: development
review:
  state: flagged
  by: opus
  at: "2026-10-08T01:55:07.820Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-post: 1
  input_hash: 02def1615a080e1993cd12116fa87fa3129dec180fc38fb142c13363d3d2fb49
evidence:
  - kind: blog
    url: https://demiliani.com/2026/05/21/be-careful-with-visual-studio-code-extensions/
    title: Be careful with Visual Studio Code extensions…
    date: "2026-05-21"
    commit: null
    t: null
    quote: null
  - kind: blog
    url: https://demiliani.com/2026/05/21/be-careful-with-visual-studio-code-extensions/
    title: Be careful with Visual Studio Code extensions…
    date: "2026-05-21"
    commit: null
    t: null
    quote: A compromised extension is just a Node.js process running inside a trusted application, with the same access rights as the developer.
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
post_id: "13761"
source_id: demiliani-com
source_name: Stefano Demiliani
url: https://demiliani.com/2026/05/21/be-careful-with-visual-studio-code-extensions/
published_at: "2026-05-21T06:50:51.000Z"
author: Stefano Demiliani
full_text: false
words: 972
quotes:
  - text: A compromised extension is just a Node.js process running inside a trusted application, with the same access rights as the developer.
    why_it_matters: "Clarifies the attack mechanism: malware executes with full developer privileges, exploiting VS Code's trust model."
code_objects_mentioned: []
systems:
  - development
  - administration
  - platform
versions_mentioned:
  - "1.96"
preview:
  embeddable: true
  frame_url: https://demiliani.com/2026/05/21/be-careful-with-visual-studio-code-extensions/embed/
  image: https://demiliani.com/wp-content/uploads/2026/05/githubhack_00.png
  image_alt: null
  image_w: 792
  image_h: 670
  site_name: Stefano Demiliani
  favicon: https://demiliani.com/wp-content/uploads/2022/09/sd_wordpress_logo.png?w=32
  probed_at: "2026-10-07T11:50:37.804Z"
---

# Be careful with Visual Studio Code extensions…

[Read the post](https://demiliani.com/2026/05/21/be-careful-with-visual-studio-code-extensions/) · Stefano Demiliani (Stefano Demiliani, MVP) · 2026-05-21 · 972 words · tier community · **flagged** (a review found a problem)

> Summary withheld: an Opus review found that the machine-written summary did not match the post. Read the original post.

## Quotes

- "A compromised extension is just a Node.js process running inside a trusted application, with the same access rights as the developer." (Clarifies the attack mechanism: malware executes with full developer privileges, exploiting VS Code's trust model.)

## Context

- Features: extensions.allowed policy, extensions.autoUpdate setting, Private Marketplace, Azure Artifacts Universal Package, Windows Defender Application Control, icacls file permissions
- Versions: 1.96

Source: Stefano Demiliani, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.