Researchers found malicious VS Code extensions and Go, npm, and Rust packages stealing developer data via hidden payloads and exfiltration.

Threat actors are still abusing Visual Studio Code extensions as an entry point, with the latest fake Prettier incident ...

VSCodium avoids this entire issue. It is a community-driven option for those who don't want the proprietary distribution ...

The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms.

The Visual Studio Marketplace and the Open VSX Registry users are targeted once again with infostealing malware.

Microsoft has launched the VS Code Insiders Podcast, a new behind-the-scenes audio show that digs into experimental features, the people building them and what may be coming next to Visual Studio Code ...

Microsoft rolls out Model Context Protocol support in Windows ML, providing tools to build agentic Windows applications that ...

The Glassworm campaign is proving to be more persistent than expected. After malicious extensions appeared in both the ...

The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, say researchers.

Malicious npm package mimics an ESLint plugin, embeds an AI-tricking prompt, and steals environment variables via a ...

North Korean hackers intensify their efforts against blockchain and Web3 developers, using nearly 200 malicious npm packages ...

North Korean attackers have delivered more than 197 malicious packages as part of ongoing state-sponsored activity to ...