Malicious VS Code and Cursor extension reached up to 5,000 users

published 2026-11-15

A hijacked extension distributed through the VS Code Marketplace reached up to 5,000 users and can steal secrets readable on the machine, such as GitHub tokens, SSH keys and API keys in .env files. An attacker with those secrets can take over the victim's accounts and code repositories.

Source: @TheHackersNews on X

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 3389 and your operating system.