VSCorode: Inside Your IDE, Inside Your Git Repository
summary
Shows a working malicious VS Code extension that reads the local secrets sqlite and OS keyring (Chromium/Electron flow), stole GitHub token in the demo, and proves marketplace publishing needs only a PAT plus the CLI so typo‑squatted themes can reach tens of thousands of users. Workspace Trust and the marketplace virus scan do not prevent runtime code execution; encrypted values use a derived master key and a V10 fallback is insecure. Recommends least privilege, block unmanaged extensions and run strict extension allowlists.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:04IDE evolution and VS Code
- 6:20Why VS Code is targeted
- 8:12VS Code features for attackers
- 13:54Workspace trust limits
- 16:24VS Code attack vectors
- 18:11Malicious extensions risks
- 24:06Privilege escalation and theft
- 27:00Secret storage deep dive
- 33:46VS Code security advice
- 36:59Q&A
related talks
46mVSCorode: Inside Your IDE, Inside Your Git Repository
21mSecurity begins with secure development environments
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
29mHunting Malicious IDE Extensions: Building Detection at Scale... (Vinod Tiwari)
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws
43mHow to hack and defend (your) open source
40mMarkDoom: How I Hacked Every Major IDE in 2 Weeks
58mWriting VS Code extensions for fun and profit