--- title: The Hidden Risk of Extensions description: Extensions are convenient pieces of software that, as the name implies, extend the functionalities of an existing piece of software. They're small, optional and designed for convenience, like a browser plugin to block ads or a Visual Studio extension to format code. An important reminder is that extensions are software that runs inside highly trusted environments, like your browser and your IDE, making them part of your attack surface. image: https://8west.ie/hubfs/8-West-Consulting-Article-the-hidden-risk-of-extensions.png --- [![Navigate to: 8 West Consulting website Homepage](https://8west.ie/hubfs/SEO_optimized_media/8_west_logo.webp)](https://8west.ie/) [![8 West Consulting: leftward chevron icon](https://8west.ie/hubfs/SEO_optimized_media/8-West-Consulting-leftward-chevron-icon.png) Back to main insights page](https://8west.ie/insights) ## ARTICLE # The Hidden Risk of Extensions security Extensions are convenient pieces of software that, as the name implies, extend the functionalities of an existing piece of software. They're small, optional and designed for convenience, like a browser plugin to block ads or a Visual Studio extension to format code. An important reminder is that extensions are software that runs inside highly trusted environments, like your browser and your IDE, making them part of your attack surface. ![8 West Consulting - Article - The Hidden Risk of Extensions](https://8west.ie/hubfs/8-West-Consulting-Article-the-hidden-risk-of-extensions.png) ![Avatar picture of the author: Marcello Carboni](https://8west.ie/hubfs/8-West-Consulting-member-Marcello-Carboni.png) ### Marcello Carboni #### Cyber Security Specialist, 8 West Consulting SHARE ON [![Click to share this article on Linkedin](https://8west.ie/hubfs/SEO_optimized_media/8-west-Consulting-icon-logo-linkedin.png)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2F8west.ie%2Finsights%2Fthe-hidden-risk-of-extensions) August 26, 2026 ### The Hidden Risk   Modern extensions often operate with broad privileges. A browser extension can read page content, access session cookies and monitor your activity inside a website. An IDE extension can read source code, inspect local files and access environment variables. In many cases they update automatically and silently, becoming persistent.   This combination of high privilege access, automatic updates and often blind trust makes them very attractive to attackers.   Browser extensions have been massively used to distribute infostealers for years, with very serious consequences. In 2019, researchers uncovered a group of popular Chrome and Firefox browser extensions that were collecting and monetizing user's browsing data. These extensions had collectively millions of downloads and captured information including personal, corporate and government.   This leak has been named "DataSpii" and impacted agencies such as the Pentagon and large corporations like Amazon, Apple, Microsoft and many others. This stolen data was then made available to a commercial data marketplace.   Over the past several years we've also seen multiple malicious extensions being discovered in the Visual Studio code marketplace. Some used typosquatting - a technique where the malicious extension impersonates a popular extension using minor spelling mistakes to trick distracted developers into unknowingly download malware. Other appear legitimate, while secretly acting as infostealers or cryptominers. Several accumulated thousands of downloads before being removed from the marketplace.   Other attack vectors include supply chain attacks: An extension may behave legitimate for months or years, accumulating a large number of installs. Later, if the developer account is compromised or the maintainer turns malicious, a single update can distribute malware to every machine where the extension is installed, compromising potentially thousands of machines.   A recent example is Amazon Q, a free agentic GenAI extension for Visual Studio Code. On July 13, 2025, a malicious commit on GitHub included a prompt to delete system and cloud resources and was only caught 10 days after, with Amazon pushing a new patched version the day after. The extension has more than 1 million downloads and around 5.6% of extensions were compromised.     ### Conclusion   Extensions are useful and convenient, but are also third-party code running inside our trusted environments. As the examples above show, when that trust is abused, the impact can reach corporate networks, personal data and even critical infrastructure.   Extensions need to be treated as part of the supply chain, applying the same scrutiny reserved to external libraries and cloud providers.     ### References and Further Reading   - [https://www.techradar.com/pro/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands](https://www.techradar.com/pro/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands) - [https://en.wikipedia.org/wiki/DataSpii](https://en.wikipedia.org/wiki/DataSpii) Enjoyed this article? Follow Marcello Carboni for more insights and commentary on: [![Social Icon: Linkedin](https://8west.ie/hubfs/SEO_optimized_media/8-west-Consulting-icon-logo-linkedin.png) LINKEDIN](https://www.linkedin.com/in/marcello-carboni-b01228186) [Security and Regulatory Compliance Services](https://8west.ie/services/security) [BOOK A SCOPING CALL](https://8west.ie/about-us/contact-us) [![8 West Consulting: chevron icon](https://8west.ie/hubfs/SEO_optimized_media/8-West-Consulting-leftward-chevron-icon.png) ALL POSTS](https://8west.ie/insights) [NEXT ARTICLE ![8 West Consulting: chevron icon](https://8west.ie/hubfs/SEO_optimized_media/8-West-Consulting-leftward-chevron-icon.png)](https://8west.ie/insights/make-claude-talk-aircraft-manual-language-asd-ste100) ## RELATED CONTENT ![Getting Started with Wayfinder](https://8west.ie/hubfs/8%20West%20Consulting%20-%20Article%20-%20Russ%20Painter%20-%20Getting%20Started%20with%20Wayfinder.jpg) #### ARTICLE [Getting Started with Wayfinder](https://8west.ie/insights/getting-started-with-wayfinder) ![Make Claude Talk Aircraft Manual Language (ASD-STE100)](https://8west.ie/hubfs/SEO_optimized_media/impact_engagements_cards_imgs/8-West-Consulting-Article-Make-Claude-Talk.png.png) #### ARTICLE [Make Claude Talk Aircraft Manual Language (ASD-STE100)](https://8west.ie/insights/make-claude-talk-aircraft-manual-language-asd-ste100) 8 West Consulting © 2026 [Privacy Policy](https://8west.ie/privacy) [Sitemap](https://8west.ie/sitemap) [![Navigate to: 8 West Consulting Facebook page](https://8west.ie/hubfs/SEO_optimized_media/8-west-Consulting-icon-logo-facebook.png)](https://www.facebook.com/8westconsulting/) [![Navigate to: 8 West Consultng Youtube Channel](https://8west.ie/hubfs/SEO_optimized_media/8-west-Consulting-icon-logo-youtube-white.png)](https://www.youtube.com/@8westconsulting) [![Navigate to: 8 West Consulting Instagram business profile](https://8west.ie/hubfs/SEO_optimized_media/8-west-Consulting-icon-logo-instagram.png)](https://www.instagram.com/8westconsulting/) [![Navigate to: 8 West Consulting LinkedIn business profile](https://8west.ie/hubfs/SEO_optimized_media/8-west-Consulting-icon-logo-linkedin.png)](https://www.linkedin.com/company/8-west-consulting) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Marcello Carboni", "url" : "https://8west.ie/insights/author/marcello-carboni" }, "dateModified" : "2026-08-26T07:06:51.191Z", "datePublished" : "2026-08-26T07:03:12.000Z", "headline" : "The Hidden Risk of Extensions", "image" : [ "https://8west.ie/hubfs/8-West-Consulting-Article-the-hidden-risk-of-extensions.png" ], "mainEntityOfPage" : { "@id" : "https://8west.ie/insights/the-hidden-risk-of-extensions", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://8west.ie/hubfs/Imported%20images/logos/8West.png" }, "name" : "8 West Consulting" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://8west.ie/#organization", "@type" : "Organization", "areaServed" : [ "Europe", "United States", "Global" ], "contactPoint" : [ { "@type" : "ContactPoint", "availableLanguage" : [ "English" ], "contactType" : "sales", "email" : "info@8west.ie" }, { "@type" : "ContactPoint", "areaServed" : "IE", "contactType" : "sales", "telephone" : "+353 21 4925100" }, { "@type" : "ContactPoint", "areaServed" : "IE", "contactType" : "support", "telephone" : "+353 21 4925155" } ], "description" : "8 West Consulting is an ISO 27001-certified software partner delivering enterprise systems for complex, regulated Health InsurTech and ecommerce environments.", "knowsAbout" : [ "Software development", "Cloud engineering", "Data engineering", "Artificial intelligence", "Dev Ops", "Cybersecurity", "Ecommerce", "Health insurance technology (Health Insurtech)", "Digital marketing" ], "logo" : { "@type" : "ImageObject", "url" : "https://145696986.fs1.hubspotusercontent-eu1.net/hubfs/145696986/SEO_optimized_media/8-West-Consulting-Logo-250x250.png" }, "name" : "8 West Consulting", "sameAs" : [ "https://www.facebook.com/8westconsulting", "https://www.youtube.com/@8westconsulting", "https://ie.linkedin.com/company/8-west-consulting", "https://www.instagram.com/8westconsulting/" ], "url" : "https://8west.ie/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://8west.ie/#website", "@type" : "WebSite", "name" : "8 West Consulting", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : "https://8west.ie//search?q={search_term_string}" }, "publisher" : { "@id" : "https://8west.ie/#organization" }, "url" : "https://8west.ie/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://8west.ie/insights#1002", "@type" : "WebPage", "about" : { "@id" : "https://8west.ie/#organization" }, "description" : "This page collects the original articles, webinars, and white papers produced and published by the members of 8 West Consulting.", "isPartOf" : { "@id" : "https://8west.ie/#website" }, "name" : "Insights | 8 West Consulting", "url" : "https://8west.ie/insights" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://8west.ie/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://8west.ie/insights", "name" : "Insights", "position" : 2 } ] } ```