MAL-2025-696 Malicious code in vscode-bazel-bsp (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-690 Malicious code in theme-check-vscode (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-342 Malicious code in op-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc75870385e27f624816db6a388a5a188640a523bb7d967dbb848ac33dda21b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in op-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc75870385e27f624816db6a388a5a188640a523bb7d967dbb848ac33dda21b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-tcf-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 081bab0ec2ee34f3590622d06dc898c469bd03a5919b3f05c6637e0744439f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-256 Malicious code in vscode-tcf-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 081bab0ec2ee34f3590622d06dc898c469bd03a5919b3f05c6637e0744439f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-188 Malicious code in flow-for-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 742d06c1ae23b840fac7171256afdfb012d6a1dff8154d55ffe9cc41d79ef968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flow-for-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 742d06c1ae23b840fac7171256afdfb012d6a1dff8154d55ffe9cc41d79ef968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-gestalt (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b869acaad1d20750b0c435dea2d0a474208819d32ba8a1b00d42d57f850e65ed Any computer that has this package install...

MAL-2025-79 Malicious code in vscode-gestalt (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b869acaad1d20750b0c435dea2d0a474208819d32ba8a1b00d42d57f850e65ed Any computer that has this package install...

Malicious code in vscode-dotnet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24b8e33604973dbb3009563bb44c06e76ba342d0a691e0ecb3341e94dadc47e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12128 Malicious code in vscode-dotnet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24b8e33604973dbb3009563bb44c06e76ba342d0a691e0ecb3341e94dadc47e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56083

Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomlygeneratedstring.devinapps.com URL aka the VSCode live share URL for a specific "Use Devin's Machine" session. For example, this URL may be discovered if a customer posts a...

Malicious code in vscode-reh-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 645c7a216c974ca0e1e77bbdfbbd3659bf3ea42e681d987c858de32c8f3bcc34 The OpenSSF Package Analysis project identified 'vscode-reh-rce' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11801 Malicious code in vscode-reh-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 645c7a216c974ca0e1e77bbdfbbd3659bf3ea42e681d987c858de32c8f3bcc34 The OpenSSF Package Analysis project identified 'vscode-reh-rce' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11485 Malicious code in vscode-dotnet-runtime (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vscode-dotnet-runtime (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dashlane-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79f2a48c1181725012456cc91fb5af9013cdea7e6e5b193c8cd5947f247a4d52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10905 Malicious code in dashlane-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79f2a48c1181725012456cc91fb5af9013cdea7e6e5b193c8cd5947f247a4d52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in huggingface-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 05d5f0f4f0cc4f4b8a99f6a6b4c1ca2e0aa13ab6cd2d0d7fd3e7a23a2d9593cb The OpenSSF Package Analysis project identified 'huggingface-vscode' @ 100.2.2 npm as malicious. It is considered malicious because: - The packa...