Ten popular Visual Studio Code extensions were found secretly installing XMRig miners, exploiting users’ CPUs for unauthorized cryptomining.

VSCode extension errors in Cursor? Learn why Microsoft's licensing restricts C/C++ & Remote SSH in non-Microsoft editors. Discover open-source alternatives

One threat actor. Two major marketplaces. Nearly 3 million installs. The numbers may have been faked — but the backdoors they dropped were…

Inside the Stealth Supply Chain Attack That Nearly Compromised Thousands

This isn’t just my sob story, it’s a warning for anyone using VS Code and Cursor.

Last time in Vibe Coding, our hero — the midnight programmer — found their groove, coding with lo-fi beats, coffee energy, and vibes…

ZAST EXPRESS plugin brings our zero false positive AI directly to your IDE:

GuardDog is a CLI tool that uses heuristics and Semgrep rules to scan for malicious npm, PyPI, Go, and VSCode packages, helping to secure the software supply chain.

A Close Call: How a Malicious Pull Request Nearly Unleashed a Wiper Attack via Amazon Q Developer

Visual Studio Code (VS Code) has become the beating heart of modern software development — fast, flexible, and open. But new research from…

Wiz found 550+ secrets (PATs, API keys) leaked in 500+ VSCode extensions, enabling an attacker to push malicious updates to 100K+ developers. Dotfiles were the main culprit.

The TigerJack group is attacking developers via malicious VSCode extensions on OpenVSX. Plugins secretly steal C++ source code in real-time and deploy the CoinIMP cryptojacker.