Visual Studio Code and AI-powered IDEs such as Cursor AI and Windsurf are emerging as one of the most critical and overlooked attack surfaces in the modern software supply chain.
Installed on millions of developer machines worldwide, these tools often run with access to source code, secrets, and production credentials.
New research shows that compromising developers via malicious extensions is not only feasible but also alarmingly easy.
Security researcher Mazin Ahmed demonstrated how a seemingly benign VS Code extension can be turned into a powerful backdoor while evading Microsoft’s marketplace checks, antivirus engines, and popular endpoint security products.
To test the ecosystem’s defenses, Ahmed created “Piithon-linter,” a fake Python linter pitched as a code formatter with “magical” capabilities.
Behind the scenes, the extension quietly exfiltrated environment variables and system metadata each time VS Code launched.
Because VS Code inherits the environment variables of the shell that starts it, this data can include highly sensitive secrets such as cloud keys and access tokens.
In a real-world attack, those values could be sent directly to an attacker-controlled command-and-control (C2) server as soon as the developer opens their IDE.
Ahmed packaged Piithon-linter as a standard VSIX and submitted it to Microsoft’s official VS Code Marketplace.
How Malicious Extensions Operate
Despite containing obviously malicious behavior with no obfuscation, the extension was approved and publicly listed. Any developer could discover and install what was, in effect, packaged malware.
The researcher then turned to OpenVSX, the open-source extension marketplace that powers many VS Code forks and AI-driven IDEs, including Cursor AI, Windsurf, and AWS Kiro. There, the extension was again accepted and made searchable.
According to the research, OpenVSX currently performs virtually no automated security checks, relying instead on user reporting and terms-of-service compliance a model unlikely to deter determined adversaries.
In a second phase, Ahmed upgraded Piithon-linter into a full backdoor. The extension added explicit antivirus and EDR checks, simple geofencing logic, and automated deployment of the Merlin post-exploitation agent for Windows, macOS, and Linux.
The code to detect security products and sandbox environments was intentionally left unobfuscated and easy to spot, yet the extension still passed Microsoft’s malware scans and sandbox execution. VirusTotal also failed to flag the samples.
Future Implications for Developer Security
Because VS Code auto-launches installed extensions and updates them by default, such a backdoor gains persistent, renewable access to developer machines.
Each IDE restart can re-establish attacker control or deliver new payloads, all under the guise of a trusted marketplace extension.
Without stronger, layered security controls on VS Code, OpenVSX, and the AI-powered IDEs that depend on them, malicious extensions could enable some of the most consequential breaches the industry has yet seen.
Ahmed responsibly disclosed the findings to Microsoft, the Eclipse Foundation (maintainer of OpenVSX), and Cursor AI. Microsoft classified the issue as low severity, emphasizing user responsibility in choosing extensions.
The Eclipse Foundation has indicated plans to add security controls, while Cursor AI reports adding publisher verification, extension ranking changes, and its own malware scanning though Piithon-linter still passed as safe in tests.
The broader takeaway is stark: developer IDEs have become a high-value, weakly defended supply chain chokepoint.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
