In 30 minutes, we developed and published a Visual Studio Code extension that changed IDE colors while leaking source code to a remote server. This experiment exposed massive security issues in one of the most popular IDEs in the world with tens of millions of users.
Here’s how we did it:
1. Built the extension: Created a copycat of the popular “Dracula Official” theme.
2. Established credibility: With $5 and leveraging amazing loopholes in the VSCode Marketplace.
3. Inserted “malicious” code: Each time a document was opened, a beacon was sent to our server.
4. Published and observed: Within minutes, we had our first victim. A day later, we were trending with over 1000 installs. Eventually, we infiltrated several multi-billion-dollar companies, a huge cybersecurity company, and even a country’s justice court (responsible disclosure was completed).
The ease of this process and the rapid adoption by unsuspecting developers highlights a critical security threat for organizations. If we could do this in 30 minutes, imagine what a motivated threat actor could achieve.
This experiment was a wake-up call, revealing the high-risk potential of VSCode extensions. Our full story and findings are detailed in our latest blog post. Read about our journey, the eye-opening statistics, and the urgent need for better security measures by Microsoft.
Read the full research post and stay tuned for our follow-up blog posts exposing malicious extensions and how to protect your development environment.
---
Note: No one was harmed during this experiment, we’ve contacted all affected companies to remediate the issue.
