CAN YOU TRUST THAT VERIFIED SYMBOL? EXPLOITING IDE EXTENSIONS IS EASIER THAN IT SHOULD BE

Summary from the TLDR InfoSec newsletter

Researchers have found critical vulnerabilities in popular IDEs (VSCode, Visual Studio, IntelliJ IDEA, and Cursor) where malicious extensions can appear verified while containing dangerous code. The flaw enables attackers to create files that utilize verified symbols but incorporate malicious functionality, allowing them to execute system commands and potentially impact millions of developers using these platforms.