There was a new article released that discussed malicious VSCode extensions. Amit Assaraf, Itay Kruk and Idan Dardikman published “Darcula”, a typosquat of the Dracula Official theme, registered a matching domain to become a verified publisher, and reached over 100 organizations with an extension that sent system information home. Their scan of the Marketplace found 1,283 extensions with known malicious code, and the vast majority were still available for download after being reported to Microsoft. Back in 2023, researchers of Aqua Security already had investigated the security problems with the Visual Studio Code Marketplace. They created an extension by typosquatting an existing extension and observed the downloads and subsequent impact. Their fake “pretier” got more than 1,000 installs in under 48 hours, and they pointed out that the blue verified checkmark only proves that the publisher owns a domain. Most interestingly, Microsoft also has an article on the question, “Can I trust extensions from the Marketplace?”
