Hackers Target Developers Using Malicious VS Code and Cursor AI Extensions

Visual Studio Code and AI-powered IDEs such as Cursor AI and Windsurf represent significant attack surfaces in the modern software supply chain. These tools, installed on millions of developer machines worldwide, often have access to source code, secrets, and production credentials.

Recent research indicates that compromising developers through malicious extensions is both feasible and alarmingly straightforward.

Security researcher Mazin Ahmed demonstrated the potential risks by creating a VS Code extension named "Piithon-linter," which acted as a backdoor while bypassing Microsoft’s marketplace checks, antivirus engines, and endpoint security products. The extension exfiltrated environment variables and system metadata each time VS Code was launched.

Since VS Code inherits the environment variables of the shell that starts it, this data can include sensitive secrets like cloud keys and access tokens. In a real-world attack, these values could be sent directly to an attacker-controlled server when the developer opens their IDE.

The Piithon-linter extension, despite its malicious intentions, was approved and publicly listed on Microsoft’s official VS Code Marketplace. It was also accepted in OpenVSX, an open-source extension marketplace that supports many VS Code forks and AI-driven IDEs. This demonstrates the potential vulnerability in marketplace approval processes.

OpenVSX currently relies on user reporting and terms-of-service compliance for security, which may not be sufficient to deter determined adversaries.

In a subsequent phase, Ahmed enhanced Piithon-linter to function as a full backdoor, adding antivirus and EDR checks, geofencing logic, and deploying the Merlin post-exploitation agent for multiple operating systems. The extension still passed Microsoft’s malware scans and sandbox execution, and VirusTotal did not flag the samples.

Future Implications for Developer Security

With VS Code auto-launching installed extensions by default, a backdoor can gain persistent, renewable access to developer machines, potentially leading to significant security breaches.

Stronger security controls are needed for VS Code, OpenVSX, and AI-powered IDEs to prevent malicious extensions from causing severe industry breaches.

Mazin Ahmed disclosed the findings to Microsoft, the Eclipse Foundation (maintainer of OpenVSX), and Cursor AI. Microsoft classified the issue as low severity, emphasizing user responsibility in selecting extensions. The Eclipse Foundation plans to add security controls, while Cursor AI has implemented publisher verification and other measures, although Piithon-linter initially passed as safe.

The overarching concern is that developer IDEs have become a high-value, weakly defended supply chain chokepoint.

Based on reporting by GBHackers.