VSCode 恶意插件攻破 GitHub 内网
推荐指数 66.0 NO. 011 · 2026.05.21
发布2026/05/20Score101Comments36
为什么值得看
GitHub 员工安装恶意 VS Code 扩展导致约 3800 个内部仓库数据被窃取。这是供应链攻击穿透大厂内网的典型案例，所有依赖 IDE 插件生态的团队都需重新评估扩展安全策略。
编辑判断
这起事件暴露了一个长期被忽视的攻击面：开发者对 IDE 插件的权限几乎不设防。VS Code 扩展默认能访问完整文件系统和网络，而 marketplace 的审核机制远不如 npm 等包管理器成熟。之前 Snyk 和 Socket 主要盯着依赖库漏洞，IDE 插件供应链仍是盲区。
对企业来说，立竿见影的做法是启用 VS Code 的 extensionAllowList 策略，禁止员工自行安装未审核扩展。个人开发者至少应该检查已装扩展的权限范围，特别是那些请求"workspace"或"all_urls"权限的非主流插件。GitHub 作为平台方接下来大概率会推动 marketplace 的签名验证和沙箱化，这对整个开发者工具生态都是倒逼升级的信号。
社区反馈
负面 35 条评论
核心争论：VSCode 插件安全模型缺失，供应链攻击难以防范
so how did they exfiltrate the information without noticing? what OS was the developer using? what security measures were they using? yesterday discussion https://news.ycombinator.com/item?id=48191680
The 3800 repos weren't exfiltrated from the compromised machine. The malware (be it a VSCode plugin, an npm package, or whatever is next) simply slurps up all of the users private keys/tokens/env-vars it can find and sends this off somewhere covertly. It's trivial to do this in a way to av
> The malware (be it a VSCode plugin, an npm package, or whatever is next) Not the first time we've seen a developer get popped thanks to a malicious game mod either...