VSCorode: Inside Your IDE, Inside Your Git Repository
summary
Shows a working malicious extension that reads VS Code’s sqlite secrets DB and the OS keyring master secret via the secret storage API, decrypts tokens (v11/v10 behavior) and exfiltrates a GitHub token; demos run and tokens are retrievable. Marketplace checks are only signature antivirus and domain verification for publisher ticks, typosquatting has infected tens of thousands in prior reports. Recommends least privilege for developer machines and explicit extension management because workspace trust and current controls do not stop runtime malicious code.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:04IDE evolution and VS Code
- 6:20Why VS Code is targeted
- 8:12VS Code features for attackers
- 13:54Workspace trust limits
- 16:24VS Code attack vectors
- 18:11Malicious extensions risks
- 24:06Privilege escalation and theft
- 27:00Secret storage deep dive
- 33:46VS Code security advice
- 36:59Q&A
related talks
46mVSCorode: Inside Your IDE, Inside Your Git Repository
21mSecurity begins with secure development environments
29mHunting Malicious IDE Extensions: Building Detection at Scale... (Vinod Tiwari)
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
43mHow to hack and defend (your) open source
34mKeep your code safe during the development path using OS tools
24mWhat every GitHub user should know about VS Code