Extension Roulette
Swipe through VS Code marketplace listings under time pressure. Install, reject, or inspect each extension — spot the malicious ones hiding behind fake reviews, cloned names, and suspicious permissions before time runs out.
Ready to play?
Put your awareness to the test. See if you can spot the threats before it's too late.
Launch GameWhy This Matters
Browser and IDE extensions are one of the most overlooked attack surfaces in software development. Every extension you install runs with broad permissions inside your most sensitive tools — your editor, your browser, your terminal. A malicious extension can read every file you open, capture keystrokes, exfiltrate source code, inject backdoors, and steal credentials — all while looking like a legitimate productivity tool.
Attackers exploit this trust by publishing typosquatted copies of popular extensions, buying out abandoned plugins, or hiding malicious code behind useful functionality. In 2026, Open VSX removed 77 malicious "evil twin" extensions that mimicked legitimate VS Code plugins, and supply chain attacks through IDE extensions have become a documented initial access vector for nation-state actors.
Developers are high-value targets because they hold the keys to production systems. A compromised developer workstation is often just one step away from a compromised CI/CD pipeline, cloud environment, or customer database.
What You'll Learn
Evaluate extension legitimacy by checking publisher verification, download counts, and review patterns
Spot typosquatting and name-cloning tactics used to impersonate popular extensions
Assess whether an extension's requested permissions are proportionate to its stated functionality
Build the habit of inspecting before installing — even when an extension looks useful
Related Threat Analysis
Shai-Hulud Worm Compromises 440+ npm Packages Including Keyv and Cacheable
A self-propagating infostealer worm dubbed Shai-Hulud has compromised over 440 npm packages — including widely-used libraries like keyv, cacheable, and flat-cache — collectively receiving more than 2 billion monthly downloads. The malware hijacks developer credentials to spread across the ecosystem and exfiltrates cloud secrets via GitHub.