NewsPublished 8 Jun 2026

VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks

Source Reddit Cybersecurity

Discussion

Microsoft Visual Studio Code (VS Code) has introduced a two-hour delay before automatically updating extensions to mitigate risks associated with software supply chain attacks. This delay applies to most extensions except those from trusted publishers like Microsoft, GitHub, and OpenAI, which continue to update immediately. The feature aims to provide an additional layer of protection by allowing time to detect and respond to potentially compromised or problematic extension releases. Users retain the option to manually update extensions immediately if desired. This change aligns with similar time-delay controls recently adopted by other package managers to reduce exposure to malicious package versions. The update is available starting with VS Code version 1.123.

r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments

https://thehackernews.com/2026/06/vs-code-adds-2-hour-extension-auto.html

Links cited in the discussion

https://thehackernews.com/2026/06/vs-code-adds-2-hour-extension-auto.html

Impact

The two-hour delay reduces the risk of rapidly propagating malicious or compromised extension updates by providing a short buffer period for detection and response. It limits the window during which a supply chain attack could affect users via automatic extension updates. Trusted publishers are exempt from this delay, ensuring timely updates for widely trusted extensions. There are no known exploits in the wild related to this change, and users can still manually update extensions immediately if necessary.

Defensive guidance

This feature is an official mitigation introduced by Microsoft in VS Code version 1.123. Users should update to this version or later to benefit from the automatic update delay. No additional user action is required to enable the delay if automatic updates are enabled. Users can manually update extensions at any time if immediate updates are needed. Since this is a proactive protective measure, no urgent remediation is necessary beyond updating VS Code to the supported version.

Summary

VS Code now implements a two-hour automatic update delay for extensions to limit the impact of supply chain attacks. When automatic updates are enabled, new extension versions are installed two hours after publication, except for extensions from trusted publishers which update immediately. This delay provides a buffer period to identify and mitigate potentially malicious or faulty extension releases. Users can manually trigger immediate updates if needed. This approach follows similar measures introduced by other package managers like RubyGems, npm, pnpm, and Yarn to reduce the window of exposure to malicious package versions. The feature is included starting in VS Code 1.123.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 8 Jun 2026, 06:18 UTC

Technical details

References

Community reviews

Related threats