Suspicious IDE Extension Installation via VSIX

Attackers may exploit IDE sideloading capabilities by installing malicious extensions via the VSIX format. This activity involves invoking the command-line interface for editors such as Visual Studio Code, Cursor, VSCodium, or Windsurf with the --install-extension flag. Malicious activity is characterized by the execution of these installs from common staging directories (e.g., Temp, /tmp, /dev/shm) or when the parent process is a script interpreter such as PowerShell, Python, or Node.js, rather than the editor application itself.

Impact

Successful exploitation allows for persistence within the developer environment or arbitrary code execution in the context of the user running the IDE. This may lead to credential theft, exfiltration of source code, or further compromise of the development workstation.

Recommendation

• Implement monitoring for IDE CLI invocations using the --install-extension flag to identify sideloading activity.
• Review process lineage for IDE extension installations; prioritize investigation when the parent process is a script host or installer rather than the editor binary.
• Establish a policy for managing extension sources and restrict the installation of unapproved or externally sourced VSIX files.
• Conduct regular audits of installed IDE extensions to identify unauthorized or anomalous plugins.
• If a suspicious extension is identified, uninstall it, remove the associated VSIX file, and rotate sensitive credentials or tokens that may have been accessible to the extension.