Can You Trust Your VSCode Extensions?

Aqua Nautilus researchers demonstrate that the VSCode Marketplace permits impersonation and typosquatting of popular extensions, enabling attackers to publish malicious extensions that execute arbitrary code with the user's privileges (including fetching and eval-ing remote payloads over insecure HTTP); their POC masquerading as Prettier achieved 1,000+ installs in 48 hours, highlighting significant supply-chain and developer-targeting risk.