Introducing Socket Scanning for VS Code Marketplace Extensions

As cited

Copy frozen at 2026-10-07 01:49 UTC (site build).

cloud saas

Introducing Socket Scanning for VS Code Marketplace Extensions

Socket announced experimental scanning support for VS Code Marketplace extensions to detect malicious code and risky behaviors before developers install them. The service examines over 100,000 extensions on the VS Code Marketplace and Open VSX registries for file system access, network activity, process execution, obfuscated code, and suspicious activation patterns. Socket's recent GlassWorm investigation identified a cluster of malicious VS Code extensions, including themed tools that used encrypted JavaScript and external payloads, demonstrating how supply chain threats extend to developer tools.

Why it matters: Security teams and developers rely on VS Code extensions that run with access to source code, credentials, and infrastructure; malicious or compromised extensions (as seen in GitHub's May breach via Nx Console) can expose thousands of internal repositories in a single update, making pre-adoption vetting critical.

Source published

2026-10-06 19:07 UTC

First seen by Cybersecurity Tracker

2026-10-07 00:15 UTC