Be careful with Visual Studio Code extensions…
Summary withheld: an Opus review found that the machine-written summary did not match the post. Read the original post.
post Stefano Demiliani
"A compromised extension is just a Node.js process running inside a trusted application, with the same access rights as the developer."
Quotes
- “A compromised extension is just a Node.js process running inside a trusted application, with the same access rights as the developer.” (Clarifies the attack mechanism: malware executes with full developer privileges, exploiting VS Code’s trust model.)
Context
- Features: extensions.allowed policy, extensions.autoUpdate setting, Private Marketplace, Azure Artifacts Universal Package, Windows Defender Application Control, icacls file permissions
- Versions: 1.96
Source: Stefano Demiliani, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.