Modern extensions often operate with broad privileges. A browser extension can read page content, access session cookies and monitor your activity inside a website. An IDE extension can read source code, inspect local files and access environment variables. In many cases they update automatically and silently, becoming persistent.
This combination of high privilege access, automatic updates and often blind trust makes them very attractive to attackers.
Browser extensions have been massively used to distribute infostealers for years, with very serious consequences. In 2019, researchers uncovered a group of popular Chrome and Firefox browser extensions that were collecting and monetizing user's browsing data. These extensions had collectively millions of downloads and captured information including personal, corporate and government.
This leak has been named "DataSpii" and impacted agencies such as the Pentagon and large corporations like Amazon, Apple, Microsoft and many others. This stolen data was then made available to a commercial data marketplace.
Over the past several years we've also seen multiple malicious extensions being discovered in the Visual Studio code marketplace. Some used typosquatting - a technique where the malicious extension impersonates a popular extension using minor spelling mistakes to trick distracted developers into unknowingly download malware. Other appear legitimate, while secretly acting as infostealers or cryptominers. Several accumulated thousands of downloads before being removed from the marketplace.
Other attack vectors include supply chain attacks: An extension may behave legitimate for months or years, accumulating a large number of installs. Later, if the developer account is compromised or the maintainer turns malicious, a single update can distribute malware to every machine where the extension is installed, compromising potentially thousands of machines.
A recent example is Amazon Q, a free agentic GenAI extension for Visual Studio Code. On July 13, 2025, a malicious commit on GitHub included a prompt to delete system and cloud resources and was only caught 10 days after, with Amazon pushing a new patched version the day after. The extension has more than 1 million downloads and around 5.6% of extensions were compromised.
Extensions are useful and convenient, but are also third-party code running inside our trusted environments. As the examples above show, when that trust is abused, the impact can reach corporate networks, personal data and even critical infrastructure.
Extensions need to be treated as part of the supply chain, applying the same scrutiny reserved to external libraries and cloud providers.