Attackers can abuse VS Code configuration files for RCE when a GitHub Codespaces user opens a repository or pull request.

Popular AI-powered integrated development environment solutions, such as Cursor, Windsurf, Google Antigravity, and Trae, recommend extensions that are non-existent in the OpenVSX registry, allowing ...

Please create an issue before adding a rating. Keep in mind that I work full-time. I'd LOVE to have more contributors. See the Contributing section below. yarn add -D ...

Marking its 30th anniversary on Thursday, the world’s most popular programming language faces a bitter ongoing custody battle rather than a celebration. Creators and community leaders are stepping up ...

Containers move fast. They're created and removed in seconds, but the vulnerabilities they introduce can stick around. Learn 5 core practices to help engineering and security teams manage container ...

A suspicious Visual Studio Code extension with file-encrypting and data-stealing behavior successfully bypassed marketplace review and entered the developer ecosystem. In a suspected test effort, ...

A remote access trojan dubbed SleepyDuck, and disguised as the well-known Solidity extension in the Open VSX open-source registry, uses an Ethereum smart contract to establish a communication channel ...

Michael O'Connell, Chief Analytics Officer at Spotfire explores how the company uses data science, geospatial analytics and AI to boost the energy sector As industries continue to experience ...

Cybersecurity researchers have discovered a self-propagating worm that spreads via Visual Studio Code (VS Code) extensions on the Open VSX Registry and the Microsoft Extension Marketplace, ...

When I was running the extension without manually setting the language, the scan would fail after building and analyzing the database: [2025-06-27T19:53:02.950Z] [WARN ] [CodeQLService ] Query pack ...