In May, that security gap had real consequences. GitHub confirmed that roughly 3,800 of its internal repositories were breached after one employee installed a poisoned VS Code extension. It wasn't an obscure typosquat. Nx Console had a verified publisher and millions of installs. One poisoned update turned it into a credential stealer.
Today, we’re extending Threat Center detection and Package Firewall blocking to VS Code extensions. Malicious extensions get blocked before they reach a developer’s IDE.
Why VS Code extensions are a supply chain blind spot
VS Code extensions behave like dependencies, but they aren't managed like dependencies:
- No manifest. Extensions don't appear in a lockfile or SBOM, so SCA and CI scanning never see them.
- Auto-update by default. A trusted extension can push a malicious version overnight, and every workstation pulls it in without anyone approving it. That's how the GlassWorm worm spread in October 2025: it stole publisher credentials from infected developers and used them to push malicious updates to legitimate extensions, reaching roughly 35,800 installs.
- Full access. Extensions run with the developer's permissions. Nothing stands between an extension and the secrets on the machine.
How Threat Center and Package Firewall protect VS Code
Threat Center already detects malicious packages on npm, PyPI, Go, Maven, and NuGet, and Package Firewall blocks them before they’re installed. The same protections now extend to the Visual Studio Marketplace.
Every VS Code extension and update is checked for security risks and against your policies before developers can install it. Unsafe versions won't appear in the VS Code marketplace, and developers with an existing extension stay on the last safe version. Package Firewall also blocks unsafe extensions installed through the command line. Every install is logged so security teams can track activity.
Deploy it once through the MDM you already run, and every developer workstation is covered. There's no agent running on the device, no wrapper, and no certificate. For developers, nothing changes. They browse and install extensions as usual, and the malicious ones simply aren't there.
Policy controls for VS Code extensions
Package Firewall policies for VS Code extensions support three controls:
- Malware. Block extension versions identified as malicious.
- Minimum package age. Hold back brand-new versions until they've been public long enough to be vetted. This control is built for the Nx Console scenario: a hijacked update from a trusted publisher gets caught in the waiting window instead of landing on thousands of laptops.
- Exceptions. Always allow the specific extensions your teams rely on.
Each rule can block or warn, so teams can start by monitoring and tightening over time.
Security for developer workstations
The developer workstation has become part of the software supply chain. AI coding agents are writing code, installing dependencies, executing commands, and connecting to MCP servers and other tools, all with access to the same source code, credentials, and systems as the developer.
With Coding Agent Governance, security teams can discover and govern coding agents, MCP servers, and skills, including the actions agents take. Package Firewall prevents malicious and high-risk dependencies from reaching developer workstations. Today's release extends those protections to VS Code extensions, closing another path attackers can use to compromise development environments.
Secure VS Code extensions today
Attackers aren't limiting themselves to open source packages. They're targeting the coding agents, extensions, and tools developers increasingly depend on. Endor Labs gives developers and their agents the freedom to move fast, with security controls that protect the entire development environment.
Protection for VS Code extensions is available today to all Package Firewall customers, with no upgrade required. To see it in action, book a demo.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
