Loophole allows threat actors to claim VS Code extension names

A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, but removed extensions' names can be reused. This poses a risk of threat actors publishing malicious extensions under previously legitimate names. The research team conducted experiments to confirm this vulnerability, successfully publishing extensions with names of removed packages. This technique has been observed in other open-source platforms like PyPI. The discovery highlights the increasing popularity of VS Code Marketplace among malicious actors and the need for developers to be vigilant about package security.

• Active Exploitation of CVE-2026-110936 in Siemens Software CenterExploitedCampaign2026-10-20
• French food store attack was not new, used a previously exploited vulnerabilityMediumVulnerability2026-10-12
• Apple iCloud Critical Vulnerability — Full Technical Details Coming SoonCriticalVulnerability2026-10-09
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSXCampaign2026-10-03
• CVE-2026-79417: Argus Monitor Local Denial-of-Service VulnerabilityMediumVulnerability2026-09-25