Improving Extension Security and Reducing Supply Chain Risk

[Maria Ghiondea (mariaghiondea)]

We take the security of the Visual Studio Code extension ecosystem seriously and continuously invest in improving protections for developers.
Following the recent incident, immediate actions were taken to limit impact and protect users. The affected extension version was removed within hours and we want to improve so in the future, it’s removed within minutes. Additional monitoring and investigation were initiated to validate the scope of impact and ensure no further exposure. Visual Studio Code 1.123 added delayed extension auto-updates (cooldown period) to help for cases where publisher credentials were stolen and publisher themselves detects in the time frame of our delay.
Building on this response, we are strengthening safeguards across the extension lifecycle to better protect users from emerging supply chain threats. This includes improving detection of suspicious or malicious behavior in extensions, such as identifying unusual runtime behavior, unexpected network activity, or significant changes in extension structure, and expanding the coverage and effectiveness of security scanning and monitoring systems.
We are also enhancing our ability to respond more quickly when issues are identified, including streamlining processes to remove or disable harmful extension versions and improving security signal ingestion. These efforts help reduce the time between detection and mitigation.
In parallel, we will be working with extension publishers to improve ecosystem-wide security posture. This includes encouraging stronger account protections and more secure publishing practices, such as hardened credentials, scoped access, and improved safeguards around publishing workflows, including short lived tokens (OIDC), 2-factor authentication and proof of presence. For example, Publishing Extensions | Visual Studio Code Extension API has been updated with recommended guidance on secure publishing from Azure DevOps.
Our goal is to ensure that developers can confidently discover and use extensions while minimizing exposure to supply chain risks. We will continue to evolve our protections and collaborate with the broader ecosystem to strengthen security across the extension platform. For feedback and suggestions: Issues · microsoft/vsmarketplace. to strengthen security across the extension platform.