VS Code, or Visual Studio Code, is a widely used code editor that supports extensions for language support, debugging, and workflow automation. Those extensions run inside the editor’s extension host, which means VS Code is more than a text editor: it is a controlled execution environment on a developer’s machine.
This matters in cyber security because the extension ecosystem can become a supply-chain risk. A malicious or compromised add-on may read source code, steal tokens, API keys, browser sessions, or other local secrets, and then exfiltrate them through normal network traffic. In real attacks, adversaries abuse trusted marketplaces, lookalike publisher names, and obfuscated code to make harmful extensions appear legitimate. Defenders reduce this risk with enterprise allowlists, private marketplaces, Workspace Trust, publisher review, and secret-scanning controls.