CuraSec

tag: Malicious-Extensions · 2 items

Act Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Dev Data
2026-08-05 · The Hacker News · source ↗ #supply-chain#malicious-extensions#developer-tools
  • Engineer — Act: If your team uses Open VSX-sourced extensions (common in Theia, Gitpod, or VS Code OSS environments), audit installed extensions against the 77 removed packages and remove any installed between July 26–August 1, 2026; check build/dev environments for unexpected outbound connections during that window.
  • SOC/IR — Act: Hunt for anomalous outbound traffic from developer workstations and CI runners between July 26 and August 1, 2026 that may indicate data exfiltration from compromised extensions; correlate against Open VSX extension install events in endpoint logs.
  • Leader — Plan: This incident illustrates supply-chain risk in developer tooling marketplaces; work with engineering leads this quarter to establish an approved-extension policy and inventory for IDE plugins used across the org.
Act 77 Open VSX extensions caught harvesting developer environment data
2026-08-05 · BleepingComputer · source ↗ #supply-chain#malicious-extensions#developer-tools
  • Engineer — Act: If your team uses Open VSX (common in VS Code OSS or VSCodium environments), audit installed extensions against the removed list and purge any matches; review extension installation policies in CI/CD or dev container configs to restrict to known-good sources.
  • SOC/IR — Plan: Build or tune detections for unexpected outbound connections from IDE processes (code, codium) to unknown endpoints; consider hunting for extension-related network activity in EDR telemetry from developer workstations over the past 90 days.
  • Leader — Learn: This incident illustrates ongoing supply-chain risk in developer tooling marketplaces; useful context for evaluating software vetting policies in engineering onboarding, but no immediate leadership action required.