{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ide-extension/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Visual Studio Code","Cursor","VSCodium","Windsurf"],"_cs_severities":["medium"],"_cs_tags":["persistence","ide-extension","software-supply-chain","endpoint"],"_cs_type":"advisory","_cs_vendors":["Microsoft","Cursor","VSCodium","Windsurf"],"content_html":"\u003cp\u003eAttackers may exploit IDE sideloading capabilities by installing malicious extensions via the VSIX format. This activity involves invoking the command-line interface for editors such as Visual Studio Code, Cursor, VSCodium, or Windsurf with the --install-extension flag. Malicious activity is characterized by the execution of these installs from common staging directories (e.g., Temp, /tmp, /dev/shm) or when the parent process is a script interpreter such as PowerShell, Python, or Node.js, rather than the editor application itself.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for persistence within the developer environment or arbitrary code execution in the context of the user running the IDE. This may lead to credential theft, exfiltration of source code, or further compromise of the development workstation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement monitoring for IDE CLI invocations using the --install-extension flag to identify sideloading activity.\u003c/li\u003e\n\u003cli\u003eReview process lineage for IDE extension installations; prioritize investigation when the parent process is a script host or installer rather than the editor binary.\u003c/li\u003e\n\u003cli\u003eEstablish a policy for managing extension sources and restrict the installation of unapproved or externally sourced VSIX files.\u003c/li\u003e\n\u003cli\u003eConduct regular audits of installed IDE extensions to identify unauthorized or anomalous plugins.\u003c/li\u003e\n\u003cli\u003eIf a suspicious extension is identified, uninstall it, remove the associated VSIX file, and rotate sensitive credentials or tokens that may have been accessible to the extension.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T21:42:39Z","date_published":"2026-11-03T21:42:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-suspicious-ide-extension-install/","summary":"Threat actors can gain persistence or code execution by sideloading malicious IDE extensions via the VSIX format, often triggered by script hosts or from volatile staging directories.","title":"Suspicious IDE Extension Installation via VSIX","url":"https://feed.craftedsignal.io/briefs/2026-11-suspicious-ide-extension-install/"}],"language":"en","title":"CraftedSignal Threat Feed - Ide-Extension","version":"https://jsonfeed.org/version/1.1"}