VSCODE IDE FORKS EXPOSE USERS TO “RECOMMENDED EXTENSION” ATTACKS

Summary from the TLDR InfoSec newsletter

AI-powered IDEs such as Cursor and Windsurf have been exposing users to additional risk by recommending non-existent extensions in the OpenVSX registry. These IDEs are forked from Microsoft VSCode, but cannot use extensions from the official store. However, they are supported by OpenVSX. Researchers from Koi have discovered several recommended extensions that are not available in the OpenVSX marketplace and are vulnerable to attackers claiming namespaces to deliver malicious extensions.