Devs: Vet Your VS Code Plugins with Spectra Assure Community

The report warns that compromised Visual Studio Code extensions can enable credential theft, CI/CD infiltration, and downstream supply chain attacks, noting Microsoft’s safeguards but emphasizing shared responsibility. It introduces Spectra Assure Community, a service that continuously evaluates Marketplace extensions for malware, tampering, and vulnerabilities, exposes behaviors and dependencies (CycloneDX), and maintains version histories to help developers assess update risk and select safer plugins.