A critical security vulnerability has been discovered in popular Integrated Development Environments (IDEs) that allows malicious actors to bypass trust verification systems and execute code on developer machines while maintaining the appearance of legitimate, verified extensions.

The flaw affects some of the most widely used development platforms including Visual Studio Code, Visual Studio, IntelliJ IDEA, and Cursor, potentially exposing millions of developers worldwide to sophisticated supply chain attacks.

The vulnerability enables attackers to create malicious extensions that retain verified symbols and trusted publisher information while secretly containing code capable of executing operating system commands.

This creates a dangerous false sense of security for developers who rely on verification badges as indicators of extension safety.

The attack vector is particularly concerning because it targets the development environment itself, where sensitive code, credentials, and proprietary information are regularly handled.

Research conducted between May and June 2025 revealed that attackers can modify extension files to maintain verified status while injecting malicious functionality.

OX Security analysts identified the specific mechanism through which these trust checks can be circumvented, demonstrating how extensions can be packaged into VSIX files and distributed through platforms like GitHub while appearing completely legitimate to end users.

The exploitation process centers on manipulating the verification requests that IDEs send to marketplace servers.

When Visual Studio Code checks an extension’s legitimacy, it sends a POST request to marketplace.visualstudio.com containing the extension’s identifier.

Researchers discovered that by modifying specific values within the extension’s bundled files, particularly the package.json and extension.js files, attackers can maintain the verified appearance while introducing malicious code.

Technical Infection Mechanism

The attack methodology involves sophisticated manipulation of extension metadata and verification processes.

Attackers begin by analyzing legitimate verified extensions to extract their publisher information, extension IDs, and verification tokens.

Malicious extension to appear legitimate (Source – OX)

They then create malicious extensions using these extracted credentials, effectively impersonating trusted publishers while injecting harmful code.

The malicious code implementation demonstrates the severity of potential attacks. In the proof-of-concept developed by researchers, attackers added a command entry to the package.json file that appears benign but triggers malicious functionality.

The corresponding extension.js file contains JavaScript code that executes system commands when activated, such as launching the calculator application as a demonstration of arbitrary code execution capabilities.

The packaging process involves creating VSIX files that contain all the modified components while preserving the visual indicators of trust that developers expect to see.

These files can be distributed through various channels, including GitHub repositories, where developers often download and install extensions locally.

The verification symbols, download counts, and publisher information all appear authentic, making detection extremely difficult without deep technical analysis.

The vulnerability’s impact extends beyond simple code execution, as successful exploitation provides attackers with access to the developer’s complete working environment, including source code, development databases, API keys, and deployment credentials.

This positions the attack as a particularly dangerous vector for supply chain compromises, where malicious code could be introduced into software projects and subsequently distributed to end users.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now

The post IDE Extensions Like VSCode Let Attackers Bypass Trust Checks and Malware on Developer Machines appeared first on Cyber Security News.