Extension Resurrection: How Dangling Dependencies in VS Code Extension Packs Enable Zero-Click RCE Across 500,000+ Developer Machines
Executive Summary
Developer environments have emerged as one of the most critical and under-defended attack surfaces in the modern enterprise. While engineering organizations invest heavily in securing runtime infrastructure, CI/CD pipelines, and cloud perimeters, the Integrated Development Environment (IDE) remains an inherently privileged domain with unfettered access to proprietary source code, internal network routes, and high-value credentials.
On August 13–14, 2026, cybersecurity research firm Bloom Security publicly disclosed a critical software supply chain attack vector affecting Microsoft's Visual Studio Code Marketplace and the Eclipse Foundation's Open VSX Registry, dubbed "Extension Resurrection" (The Next Web, Business Insider).
The vulnerability stems from "Shadow Dependencies"—dangling references inside legitimate, highly trusted extension packs that point to deleted, unmaintained, or abandoned extension namespaces. By claiming these unowned namespaces and publishing malicious extension packages, an adversary can achieve zero-click Remote Code Execution (RCE) on developer workstations via VS Code's automated background extension update mechanism. Across the two marketplaces, Bloom Security identified more than 750 affected extension packs with an aggregate installation count exceeding 500,000 downloads (Cybersecurity Dive).
Deep-Dive Technical Analysis: The Anatomy of Extension Resurrection
1. Extension Packs and the Mechanics of "Shadow Dependencies"
In modern software development, developers frequently rely on Extension Packs—curated bundles that allow engineers to install complete technology stacks (e.g., Python linters, code formatters, debuggers, language servers, and test runners) through a single click. In Visual Studio Code and compatible IDEs, an extension pack is defined within its manifest file (package.json) under the extensionPack array:{
"name": "full-stack-essentials",
"publisher": "trusted-curator",
"version": "2.1.0",
"extensionPack": [
"golang.go",
"dbaeumer.vscode-eslint",
"abandoned-author.prettify-json"
]
}
The underlying vulnerability arises when an extension listed in an extensionPack is deleted by its author, removed by marketplace administrators, or when the original publisher's account or domain registration lapses. Because the parent extension pack is rarely updated immediately to remove the reference, the manifest retains a dangling pointer—a "shadow dependency" that is expected by client IDEs but does not actively exist in the marketplace catalog (Bloom Security Press Release).
Bloom Security's automated scanning uncovered significant exposure:
* VS Code Marketplace: 677 out of 4,179 analyzed extension packs contained at least one shadow dependency, including 60 extension packs where the referenced publisher account was completely unregistered.
* Open VSX Registry: 94 out of 321 scanned extension packs contained dangling shadow dependencies, with manifest-declared extension dependencies also exhibiting similar exposure (The Next Web).
2. Namespace Hijacking & Extension Resurrection
Because the target extension namespace (e.g., abandoned-author.prettify-json) no longer has an active owner on the registry, an attacker can register an account matching the missing publisher name, create the extension with the expected identifier, and upload a malicious release.
During proof-of-concept testing on Open VSX, Bloom Security demonstrated that even when a registry index retained a "phantom" record of a previously deleted extension, simply publishing a new build with an incremented semantic version number (e.g., bumping v1.0.0 to v2.0.0) caused the registry to accept the package, resurrecting the dead extension into active circulation (Business Insider).
Phase
Description of Attack Vector
Phase 1
Trusted Extension Pack Manifest contains: ["publisherX.tool-helper"]
Phase 2
Original author deletes "publisherX.tool-helper" from Marketplace.
Phase 3
Parent Extension Pack remains popular (500k+ active installs).
Phase 4
Attacker discovers dangling namespace "publisherX" is unowned.
Phase 5
Attacker registers "publisherX" and publishes malicious "tool-helper v2.0.0".
Phase 6
VS Code background update engine queries marketplace for extension updates.
Phase 7
Malicious extension silently pushed & executed on developer machines (RCE).
3. Automated Zero-Click Delivery via Background Updates
The critical catalyst that turns namespace hijacking into a widespread enterprise risk is Visual Studio Code's default update behavior. By default, VS Code enables extensions.autoUpdate = true, periodically querying the marketplace in the background for new versions of all installed extensions and extension pack components.
When the resurrected extension is published with a higher version number, client IDEs automatically fetch, unpack, and initialize the extension without requiring any user confirmation, prompt, or dialogue. The malicious code executes seamlessly within the developer's local process context.
Developer Workstation Exploitation: The Ultimate Enterprise Foothold
Unlike web browsers that enforce strict sandboxing (e.g., Same-Origin Policy, WebAssembly isolation, and restricted filesystem access), Visual Studio Code extensions execute with the full privileges of the host developer account using the Node.js runtime (vscode extension host process).
Once a resurrected extension executes on a developer endpoint, an adversary can immediately initiate high-impact exfiltration and reconnaissance:
1. Environment Secrets & API Tokens: Scanning local project workspaces for unencrypted .env, .env.local, .npmrc, and docker-compose.yml files containing database connection strings, Stripe keys, and third-party SaaS tokens.
2. Cloud & Infrastructure Credentials: Exfiltrating AWS credentials (~/.aws/credentials), Google Cloud tokens (~/.config/gcloud/), Azure CLI sessions, and Kubernetes kubeconfig files (~/.kube/config).
3. SSH Keys & Git Access: Stealing private SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519) and Git authentication credentials (~/.git-credentials), enabling silent tampering with corporate GitHub/GitLab repositories and software release tags.
4. Internal Network Pivoting: Utilizing the developer's active VPN and zero-trust network tunnels to scan internal staging environments, corporate intranets, and sensitive cloud data stores.
Disclosure Timeline and Marketplace Remediation
Bloom Security followed responsible disclosure protocols with the affected ecosystem maintainers (Bloom Security Press Release):
* February 5, 2026: Disclosed to the Eclipse Foundation's Open VSX team. Open VSX responded rapidly by assigning vulnerable namespaces to the official open-vsx account and deploying registry-level checks to prevent publishing extension packs with missing dependencies.
* February 17, 2026: Disclosed to the Microsoft Security Response Center (MSRC). Microsoft initially rated the issue as Moderate severity before reopening the case upon reviewing additional proof-of-concept telemetry.
* October 2025 – June 2026: Microsoft implemented staged protections in the Visual Studio Code Marketplace, restricting administrative and user-level resurrection of deleted publisher namespaces and auditing dangling pack references.
Actionable Mitigations for Enterprise Security Teams and Developers
The "Extension Resurrection" technique illustrates a foundational rule of software supply chain security: installing an extension once does not mean it remains static or trusted forever.
To protect developer workstations and corporate source repositories, organizations should implement the following defensive measures:
1. Disable Automatic Background Extension Updates in Enterprise Environments
Organizations should enforce central Visual Studio Code policies via Mobile Device Management (MDM) or Group Policy Objects (GPO) to prevent unmonitored background updates:
In settings.json:{
"extensions.autoUpdate": false,
"extensions.autoCheckUpdates": false
}
2. Implement Extension Allowlisting & Private Extension Registries
Enterprise security teams should restrict developers from pulling arbitrary extensions directly from public marketplaces. Deploy internal, curated extension registries (or use VS Code Enterprise allowlists) that mandate security scanning, signature verification, and manual approval before extensions can be installed.
3. Audit Installed Extension Packs & Dependency Trees
Security and DevOps teams should scan developer environments for orphaned extension dependencies. Regularly inventory installed extensions across endpoints using script-based audits:code --list-extensions --show-versions
Verify that all installed extensions originate from active, verified publishers with registered domain verification badges.
4. Enforce Endpoint Detection & Response (EDR) on Developer Workstations
Because IDE processes are prime targets for supply chain vectors, EDR agents must be configured to alert on anomalous child processes spawned by Code.exe / code (e.g., unexpected network connections, PowerShell/Bash executions, or attempts to read ~/.ssh and ~/.aws).
Sources & Reference Material:
* Cybersecurity Dive: Software Supply Chain Vulnerabilities & Extension Risks
* The Next Web: Bloom Security's Extension Resurrection Research
* Business Insider: Bloom Security Finds 'Extension Resurrection' Flaw
* Bloom Security Official Disclosure Bulletin