[Stanley]

Malicious VS Code AI Extensions with 1.5 Million Installs Steal Developer Source Code

Cybersecurity researchers have discovered two malicious Microsoft Visual Studio Code (VS Code) extensions that are advertised as artificial intelligence (AI)-powered coding assistants, but also harbor covert functionality to siphon developer data to China-based servers.
The extensions, which have 1.5 million combined installs and are still available for download from the official Visual Studio

https://thehackernews.com/2026/01/malici...th-15.html

[The Pact]

Developers thought they were getting smart autocomplete. The extensions thought they were getting free source code to ship off to servers in China.

It’s like inviting a helpful intern into your office and discovering they’ve been photocopying your notebooks and mailing them overseas for fun.