Malicious AI Extensions in VSCode Marketplace Expose Developer Data

Researchers from Koi Security identified two malicious extensions in the VSCode Marketplace, collectively installed 1.5 million times, that exfiltrate developer data to servers located in China. The extensions, named ChatGPT – 中文版 (1.34 million installs) and ChatMoss (150k installs), are marketed as AI-based coding assistants but lack transparency regarding their data collection practices.

The malicious extensions employ three distinct mechanisms for data collection. The first mechanism involves real-time monitoring of files opened in the VS Code client, where the entire contents of any accessed file are encoded in Base64 and sent to the attackers’ servers. This means that simply opening a file triggers the theft of its complete contents.

The second mechanism allows the extensions to transmit up to 50 files from the victim’s workspace each time a server-controlled command is executed. This stealthy approach significantly increases the volume of sensitive data that can be exfiltrated.

The third mechanism utilizes a zero-pixel iframe in the extension’s webview to load commercial analytics SDKs, such as Zhuge.io, GrowingIO, TalkingData, and Baidu Analytics. These SDKs are designed to track user behavior, build identity profiles, and monitor activities within the editor.

Koi Security emphasizes the risks posed by these undocumented functionalities, which can lead to the exposure of private source code, configuration files, cloud service credentials, and sensitive API keys. The presence of these extensions on the VSCode Marketplace raises serious questions about the vetting process for third-party plugins.

As of the time of publication, both malicious extensions remain available on the marketplace, and efforts to contact Microsoft for further information have not yet yielded a response. This situation underscores the importance of vigilance when using third-party extensions, especially those claiming to offer AI capabilities.

Implications for Developers and Organizations

This incident highlights the growing risks associated with AI-powered tools and extensions in software development environments. Developers must be cautious when installing extensions, particularly those that do not clearly communicate their data handling practices.

Organizations should implement strict policies regarding the use of third-party extensions and regularly audit installed plugins for potential security risks. Monitoring user behavior and data access can help mitigate the impact of such malicious tools.

Ultimately, the presence of these malicious extensions serves as a reminder of the need for robust security measures and awareness in the software development community.