VSCodium - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/vscodium/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 21:42:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSuspicious IDE Extension Installation via VSIXhttps://feed.craftedsignal.io/briefs/2026-11-suspicious-ide-extension-install/Tue, 03 Nov 2026 21:42:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-suspicious-ide-extension-install/Threat actors can gain persistence or code execution by sideloading malicious IDE extensions via the VSIX format, often triggered by script hosts or from volatile staging directories.Attackers may exploit IDE sideloading capabilities by installing malicious extensions via the VSIX format. This activity involves invoking the command-line interface for editors such as Visual Studio Code, Cursor, VSCodium, or Windsurf with the --install-extension flag. Malicious activity is characterized by the execution of these installs from common staging directories (e.g., Temp, /tmp, /dev/shm) or when the parent process is a script interpreter such as PowerShell, Python, or Node.js, rather than the editor application itself.

Impact

Successful exploitation allows for persistence within the developer environment or arbitrary code execution in the context of the user running the IDE. This may lead to credential theft, exfiltration of source code, or further compromise of the development workstation.

Recommendation

  • Implement monitoring for IDE CLI invocations using the --install-extension flag to identify sideloading activity.
  • Review process lineage for IDE extension installations; prioritize investigation when the parent process is a script host or installer rather than the editor binary.
  • Establish a policy for managing extension sources and restrict the installation of unapproved or externally sourced VSIX files.
  • Conduct regular audits of installed IDE extensions to identify unauthorized or anomalous plugins.
  • If a suspicious extension is identified, uninstall it, remove the associated VSIX file, and rotate sensitive credentials or tokens that may have been accessible to the extension.
]]>mediumadvisorypersistenceide-extensionsoftware-supply-chainendpoint