Visual Studio developers are targeted with a self-propagating worm in a sophisticated supply chain attack through the OpenVSX ...

GlassWorm spread via 14 VS Code extensions; Solana + Google Calendar C2; stole credentials, drained 49 wallets.

A remote access trojan dubbed SleepyDuck, and disguised as the well-known Solidity extension in the Open VSX open-source ...

A new malware worm campaign has infected multiple Microsoft Visual Studio Code extensions using invisible Unicode characters ...

A new cyber threat is affecting developers worldwide who work with Visual Studio Code. Researchers at Koi Security have ...

Treat this as an immediate security incident, CISOs advised; researchers say it’s one of the most sophisticated supply chain ...

Microsoft's Visual Studio Code (VS Code) code editor and development environment contains a flaw that allows malicious extensions to retrieve authentication tokens stored in Windows, Linux, and macOS ...

A new campaign involving malicious Visual Studio Code (VS Code) extensions has exposed a loophole in the VS Code Marketplace that allows threat actors to reuse names of previously removed packages.

Researchers uncover SleepyDuck RAT hidden in VSX extension, using Ethereum contracts to control infected hosts.

At its core, VS Code is built on an open source project called Code OSS, published under the permissive MIT license.