Plugins Gone Rogue

IDE extensions run inside the tools used to write and ship software. This talk examines how malicious VS Code and Visual Studio plugins can abuse that access to steal credentials, run commands, and alter code.

Examples cover backdoored plugins, typosquatting, misleading marketplace signals, and dependencies that hide the payload in another extension. The talk also looks at practical checks developers can use when choosing extensions.

Appearances

Recordings

Slides