How Researchers Built a Malicious VSCode Extension in 30 Minutes and Exposed Marketplace Security Flaws

Visual Studio Code (VSCode), a Microsoft‑released source‑code editor beloved by developers worldwide, became the target of a foreign research team that claimed to have built a "knock‑off" VSCode extension in just 30 minutes and used it to breach multiple multi‑billion‑dollar companies.

"We are at the peak of secure applications and environments, yet the most complex security layers can be bypassed in 30 minutes," the team noted.

Although the victims are not named, the researchers disclosed that a publicly listed company valued at $483 billion, several large security firms, and a national judicial court were among those compromised.

The team emphasizes that they are not malicious hackers and caused no real damage; the experiment was conducted solely to discover and solve the problem.

The three researchers—Amit Assaraf, Itay Kruk, and Idan Dardikman—identified a media report about a malicious VSCode extension that impersonated the popular "Prettier – Code formatter" extension, inspiring them to create a counterfeit version of the widely used "Dracula" dark‑theme.

They observed that large security companies consider the issue too minor, startups see no market potential, and Microsoft may even view it as beneficial to keep the extension ecosystem thriving, leaving the problem without a clear owner.

Motivated to fill the gap, the trio set out to build a malicious VSCode extension that could steal source code and exfiltrate it to a remote server.

They produced a fake "Dracula Official" theme named "Darcula Officia" (with the letters r and a swapped) that visually mimics the legitimate theme, which has over 7 million installations.

After downloading the original Dracula source code, they added extra code, duplicated all resources, and released the counterfeit extension, which initially appeared indistinguishable from the genuine one.

To increase credibility, they registered a domain (darculatheme.com) similar to the official draculatheme.com and passed VSCode Marketplace verification, which only requires domain validation.

They also added the official Dracula GitHub repository to the package.json, causing the Marketplace to list it as the official repo even though they were not the authors.

The malicious payload is a script that gathers system information (hostname, domain, platform, installed extensions, etc.) and sends it via HTTPS POST to the researchers' Retool server each time a user opens a document.

Unfortunately, traditional endpoint detection and response (EDR) tools cannot detect this malicious activity. VSCode is built to read many files, execute commands, and spawn subprocesses, so EDR cannot easily distinguish legitimate developer activity from a malicious extension.

After publishing, the counterfeit "Darcula" extension attracted its first victim within minutes and, a day later, over 100 additional victims, quickly rising to the first page of search results in the Marketplace.

Within days, the researchers reported that a $483 billion‑valued public company, dozens of multi‑billion‑dollar firms, one of the world’s largest security companies, and a national court had fallen for the trap, and the extension even appeared in the Marketplace’s trending list.

Microsoft has not yet responded to the findings.

The team subsequently surveyed the Marketplace and found alarming statistics: 1,283 extensions with known malicious code (2.29 billion installs), 8,161 extensions communicating with hard‑coded IPs, 1,452 running unknown executables, and 2,304 using another publisher’s GitHub repo, indicating widespread impersonation.

They attribute these issues to the lack of strict control and code‑review mechanisms in the VSCode Marketplace, warning that as the platform grows, the risk will only increase.

All identified malicious extensions have been reported to Microsoft, but most remain available for download, and Microsoft has not yet committed to strengthening security reviews.