Bleepingcomputer Malicious Extension Risks in AI-Powered VSCode Forks
Article Content
Browse articles 
AI-powered IDEs like Cursor, Windsurf, Google Antigravity, and Trae recommend extensions that do not exist in the OpenVSX registry. This allows threat actors to claim the namespace and upload malicious extensions, posing a risk to users. These IDEs, forked from Microsoft VSCode, rely on OpenVSX due to licensing restrictions preventing the use of the official store.
Ask AI about this cluster
Answers cite the sources they use
Updated 226d ago How this analysis works
More articles in this cluster (3)
Following this threat?
Track Koi in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…