--- title: Bloom Security’s Extension Resurrection research exposes... description: Bloom Security's 'Extension Resurrection' research found that VS Code and Open VSX extension packs can reference bundled extensions that don't actually exist... canonical: https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bloom Security’s Extension Resurrection research exposes a blind spot in developer security | daily.dev og:description: Bloom Security's 'Extension Resurrection' research found that VS Code and Open VSX extension packs can reference bundled extensions that don't actually exist... og:url: https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek og:image: https://api.daily.dev/og/posts/ww5XZwiek.png og:image:alt: Bloom Security’s Extension Resurrection research exposes a blind spot in developer security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bloom Security’s Extension Resurrection research exposes a blind spot in developer security **[The Next Web](https://daily.dev/sources/tnw)** · 5 min read · 0 upvotes · 0 comments ## Summary Bloom Security's 'Extension Resurrection' research found that VS Code and Open VSX extension packs can reference bundled extensions that don't actually exist on the marketplace, letting attackers claim those unclaimed namespaces and publish malicious extensions that get installed automatically through trusted packs. 677 of 4,179 VS Code packs and 94 of 321 Open VSX packs contained at least one such 'shadow dependency,' with combined downloads exceeding 500,000. Because extension packs don't pin versions, previously installed legitimate packs could silently pull in a malicious extension via auto-update, months or years later. Extensions run with Node.js host access, able to read/write files, spawn processes, and make network requests. Bloom disclosed the Open VSX issue to the Eclipse Foundation on February 5, 2026, and to Microsoft on February 17; Microsoft rolled out protections in stages, with admin-action protections dating to October 2025 and user-action protections completed in June 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Extension Resurrection vulnerability found in VS Code and Open VSX extension packs? It's a supply-chain flaw where extension packs reference bundled extensions that don't actually exist in the marketplace, letting an attacker register that unclaimed namespace and publish a malicious extension that automatically installs for anyone who has the pack. Bloom Security found 677 of 4,179 VS Code packs and 94 of 321 Open VSX packs affected, spanning over 500,000 downloads. _Teams auditing IDE extension risk can follow supply-chain security coverage like this on daily.dev._ ### Have Microsoft and the Eclipse Foundation fixed the extension resurrection vulnerability in VS Code and Open VSX? Yes. The Eclipse Foundation acted quickly after Bloom Security's disclosure on February 5, 2026, protecting at-risk namespaces and adding checks for nonexistent extensions and dependencies in Open VSX. Microsoft, notified February 17, rolled out fixes in stages, with administrator-action protections dating to October 2025 and user-action protections completed by June 2026. _Developers tracking IDE marketplace security fixes can stay current on daily.dev._ ### Why are VS Code extension packs a supply-chain security risk even after installation? Extension packs don't pin bundled extensions to specific versions, so a pack installed months or years earlier can later acquire a newly published, potentially malicious version of a previously missing dependency through automatic updates. Since VS Code extensions (and compatible IDEs like Cursor, Windsurf, and Kiro) run with Node.js host access, a malicious update can read/write files, spawn processes, and make network requests. _Developers relying on IDE extensions can follow ongoing supply-chain risk research via daily.dev._ ## Similar posts on daily.dev - [When Your IDE Becomes a RCE Endpoint](https://daily.dev/posts/when-your-ide-becomes-a-rce-endpoint-fwzhdkz3r) · Trendyol Tech · 6 upvotes · 1 comments - [77 Open VSX extensions found harvesting developer info](https://daily.dev/posts/77-open-vsx-extensions-found-harvesting-developer-info-d9odzy6es) · BleepingComputer · 0 upvotes · 0 comments - [GlassWorm Sleeper Extensions Activate on Open VSX, Shift to ...](https://daily.dev/posts/glassworm-sleeper-extensions-activate-on-open-vsx-shift-to--wl4e5deah) · Socket · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bloom Security’s Extension Resurrection research exposes a blind spot in developer security","url":"https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek"},"datePublished":"2026-08-13T16:08:29.690Z","dateModified":"2026-08-13T16:08:56.863Z","description":"Bloom Security's 'Extension Resurrection' research found that VS Code and Open VSX extension packs can reference bundled extensions that don't actually exist...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d657ca1e4ee624356b51571b9a68cc75?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d657ca1e4ee624356b51571b9a68cc75?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vscode","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Bloom Security’s Extension Resurrection research exposes a blind spot in developer security"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek#faq","mainEntity":[{"@type":"Question","name":"What is the Extension Resurrection vulnerability found in VS Code and Open VSX extension packs?","acceptedAnswer":{"@type":"Answer","text":"It's a supply-chain flaw where extension packs reference bundled extensions that don't actually exist in the marketplace, letting an attacker register that unclaimed namespace and publish a malicious extension that automatically installs for anyone who has the pack. Bloom Security found 677 of 4,179 VS Code packs and 94 of 321 Open VSX packs affected, spanning over 500,000 downloads. Teams auditing IDE extension risk can follow supply-chain security coverage like this on daily.dev."}},{"@type":"Question","name":"Have Microsoft and the Eclipse Foundation fixed the extension resurrection vulnerability in VS Code and Open VSX?","acceptedAnswer":{"@type":"Answer","text":"Yes. The Eclipse Foundation acted quickly after Bloom Security's disclosure on February 5, 2026, protecting at-risk namespaces and adding checks for nonexistent extensions and dependencies in Open VSX. Microsoft, notified February 17, rolled out fixes in stages, with administrator-action protections dating to October 2025 and user-action protections completed by June 2026. Developers tracking IDE marketplace security fixes can stay current on daily.dev."}},{"@type":"Question","name":"Why are VS Code extension packs a supply-chain security risk even after installation?","acceptedAnswer":{"@type":"Answer","text":"Extension packs don't pin bundled extensions to specific versions, so a pack installed months or years earlier can later acquire a newly published, potentially malicious version of a previously missing dependency through automatic updates. Since VS Code extensions (and compatible IDEs like Cursor, Windsurf, and Kiro) run with Node.js host access, a malicious update can read/write files, spawn processes, and make network requests. Developers relying on IDE extensions can follow ongoing supply-chain risk research via daily.dev."}}]} ```