VS Code Extensions Exfiltrate Developer Data
Cybersecurity researchers on Jan 26, 2026 discovered two malicious Microsoft Visual Studio Code extensions advertised as AI-powered coding assistants that covertly siphon developer data to China-based servers. The extensions have about 1.5 million combined installs and remained available from the official Visual Studio Marketplace at discovery, raising supply-chain and credential-exposure concerns. Organizations should audit installed extensions, rotate exposed secrets, and block the flagged packages.
Scoring Rationale
High practical impact and broad exposure, but limited independent verification and partial reporting reduce confidence.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
