Cybersecurity articles tagged #VS Code on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/vs-code-marketplace-abuse-detecting-malicious-developer-extensionshttps://runtimerebel.com/blog/vs-code-marketplace-abuse-detecting-malicious-developer-extensionsResearchers identify malicious Visual Studio Code extensions exfiltrating source code and credentials. Learn how to secure your development environment.Mon, 27 Jul 2026 03:19:47 GMTVS CodeMarketplace SecurityDeveloper SecuritySupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/github-dev-one-click-attack-stealing-oauth-tokens-via-vs-codehttps://runtimerebel.com/blog/github-dev-one-click-attack-stealing-oauth-tokens-via-vs-codeNew research reveals a one-click exploit in GitHub.dev and VS Code that allows attackers to steal full GitHub OAuth tokens and access private repositories.Wed, 03 Jun 2026 13:47:14 GMTGitHubVS CodeOauth TheftURI Handlerhttps://runtimerebel.com/blog/github-repository-breach-linked-to-tanstack-supply-chain-attackhttps://runtimerebel.com/blog/github-repository-breach-linked-to-tanstack-supply-chain-attackGitHub confirms the breach of 3,800 internal repositories via a compromised VS Code extension linked to the TanStack npm supply chain attack.Thu, 21 May 2026 09:15:44 GMTGitHubTanStackNPMSupply Chain AttackVS Codehttps://runtimerebel.com/blog/github-repository-breach-3800-repos-accessed-via-vs-code-extensionhttps://runtimerebel.com/blog/github-repository-breach-3800-repos-accessed-via-vs-code-extensionGitHub confirms a security incident where a malicious VS Code extension compromised an employee account, leading to the unauthorized access of 3,800 repos.Wed, 20 May 2026 09:15:55 GMTGitHubVS CodeSupply Chain AttackCredential TheftDeveloper Securityhttps://runtimerebel.com/blog/nx-console-18-95-0-compromise-vs-code-extension-credential-stealerhttps://runtimerebel.com/blog/nx-console-18-95-0-compromise-vs-code-extension-credential-stealerSecurity researchers have identified a compromised version of the Nx Console VS Code extension (18.95.0) containing a malicious credential stealer.Tue, 19 May 2026 09:18:11 GMTNx ConsoleVS CodeSupply Chain AttackRwl Angular ConsoleCredential Stealerhttps://runtimerebel.com/blog/glassworm-campaign-leverages-malicious-vs-code-extensionshttps://runtimerebel.com/blog/glassworm-campaign-leverages-malicious-vs-code-extensionsRuntime Rebel details the GlassWorm campaign, which infects developers via malicious Visual Studio Code extensions on Open VSX, facilitating a supply chain attack.Tue, 28 Apr 2026 16:45:38 GMTGlassWormVS CodeOpen VSXSupply Chain AttackMalwareDeveloper ToolsApplication Securityhttps://runtimerebel.com/blog/glassworm-malware-cloned-open-vsx-extensions-target-developershttps://runtimerebel.com/blog/glassworm-malware-cloned-open-vsx-extensions-target-developersOver 70 malicious Open VSX extensions cloned from popular tools deliver GlassWorm malware, highlighting risks in developer-focused supply chain attacks.Tue, 28 Apr 2026 12:45:16 GMTOpen VSXGlassWormVS CodeCheckmarxMalwareSupply Chain Attackhttps://runtimerebel.com/blog/compromised-checkmarx-kics-supply-chain-attack-on-developer-environmentshttps://runtimerebel.com/blog/compromised-checkmarx-kics-supply-chain-attack-on-developer-environmentsA supply chain attack compromised Checkmarx KICS Docker images and extensions, exposing developer environments to sensitive data theft. Learn mitigation.Thu, 23 Apr 2026 16:40:50 GMTCheckmarxKICSSupply Chain AttackDeveloper ToolsVS CodeDockerData Thefthttps://runtimerebel.com/blog/open-vsx-registry-security-bypass-malicious-vs-code-extensions-riskhttps://runtimerebel.com/blog/open-vsx-registry-security-bypass-malicious-vs-code-extensions-riskA logic error in the Open VSX pre-publish scanning pipeline allowed malicious VS Code extensions to bypass security checks. Read our technical analysis.Fri, 27 Mar 2026 16:23:33 GMTOpen VSXVS CodeSupply ChainSecurity BypassVSCodiumhttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-target-docker-hub-pypi-and-vs-codehttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-target-docker-hub-pypi-and-vs-codeTeamPCP expands supply chain attack tactics from GitHub Actions to Docker Hub, PyPI, and VS Code extensions, collaborating with the Lapsus$ hacking group.Wed, 25 Mar 2026 12:24:38 GMTTeamPCPLapsusSupply Chain AttackDocker HubGitHub ActionsVS Codehttps://runtimerebel.com/blog/checkmarx-kics-vs-code-plugin-targeted-in-supply-chain-attackhttps://runtimerebel.com/blog/checkmarx-kics-vs-code-plugin-targeted-in-supply-chain-attackTeamPCP exploited Checkmarx KICS, VS Code plugins, and LiteLLM in a supply chain attack targeting code scanners and AI libraries, indicating expanding threats.Wed, 25 Mar 2026 00:37:08 GMTTeamPCPCheckmarx KICSVS CodeLiteLLMSupply Chain Attackhttps://runtimerebel.com/blog/glassworm-abuses-open-vsx-registry-in-supply-chain-attackhttps://runtimerebel.com/blog/glassworm-abuses-open-vsx-registry-in-supply-chain-attackThe GlassWorm campaign exploits transitive dependencies in 72 Open VSX extensions to deliver malicious loaders into developer environments.Sat, 14 Mar 2026 16:10:23 GMTGlassWormOpen VSXSupply Chain AttackVS CodeMalware