Post by @Enigma@infosec.exchange

2026-05-27 14:24 UTC

Visual Studio Code Extensions lack a means of enforcing a minimum age to protect against updates that spread worms. There is a feature request to compel Microsoft to add this festure functionality, it only has 212 likes today. Please help give it a BIG signal boost! https://github.com/Microsoft/vscode/issues/316867

Replies (3)

@Enigma@infosec.exchange 2026-05-27 16:36

@briankrebs@infosec.exchange can we get a piece on the state of package/plugin/extensions Marketplaces being unconscionably behind on hygiene controls that have resulted in these supply chain worms? Lack of MFA for publishers, lack of hygiene control on 3rd party submitted content, lack of cool down timers on packages/clients to protect themselves from rapidly spreading infections. The whole framework has been ripe for exploitation. The garden has been left poorly tended we are now subject to the invasion of the worms as a result.

Open ##4788596
@Enigma@infosec.exchange 2026-05-28 15:17

@GossiTheDog@cyberplace.social , can we get a signal boost? Cooldown enforcement on Extensions, Packages, and Plugins are Table stakes and should not be optional or missing features from MS.

Open ##4788600
@Numerfolt@kirche.social 2026-05-28 19:55

@Enigma@infosec.exchange I was wondering why age verification for VSCode would be a good thing. Until I read "release age" 😅

Open ##4788601