Install Me Maybe

An extension ID can be trusted in one marketplace while its publisher namespace is still unclaimed in another. When an editor resolves the same ID against that second marketplace, a saved recommendation or configuration can become a route into the developer environment.

This research follows extension identifiers through VS Code, Open VSX, VS Code-derived editors, and devcontainer and migration workflows. The talk covers how to find these gaps and what proof-of-concept extensions revealed about their real-world reach.

Appearances

Recordings

Slides