--- title: Security Risks in VSCode Extensions: TigerJack and More description: Security researchers discovered over 550 leaked secrets in VS Code extensions affecting 185,000+ installations, including API keys for AI platforms, AWS, GCP,... canonical: https://daily.dev/posts/security-risks-in-vscode-extensions-tigerjack-and-more-tcd4jpiqu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Security Risks in VSCode Extensions: TigerJack and More | daily.dev og:description: Security researchers discovered over 550 leaked secrets in VS Code extensions affecting 185,000+ installations, including API keys for AI platforms, AWS, GCP,... og:url: https://daily.dev/posts/security-risks-in-vscode-extensions-tigerjack-and-more-tcd4jpiqu og:image: https://api.daily.dev/og/posts/tCd4JPiqu.png og:image:alt: Security Risks in VSCode Extensions: TigerJack and More og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Risks in VSCode Extensions: TigerJack and More **[Collections](https://daily.dev/sources/collections)** · 1 min read · 1 upvotes · 0 comments ## Summary Security researchers discovered over 550 leaked secrets in VS Code extensions affecting 185,000+ installations, including API keys for AI platforms, AWS, GCP, and database credentials. Threat actors exploited these vulnerabilities to steal source code, mine cryptocurrency, and maintain persistent access to developer machines. Microsoft has implemented secrets scanning to block vulnerable extensions, but alternative marketplaces like Open VSX remain at risk. Developers should sanitize code before publishing and organizations should maintain extension allowlists to prevent security breaches. ## Content Security researchers have uncovered over 550 leaked secrets in Visual Studio Code extensions, affecting more than 185,000 installations across VSCode Marketplace and OpenVSX. These leaks included access tokens and API keys for AI platforms, cloud services such as AWS and GCP, and database credentials, potentially allowing threat actors to conduct supply chain attacks. The vulnerabilities resulted in malicious activities, where groups like TigerJack used compromised extensions to steal source code, mine cryptocurrency, and ensure persistent remote access on developer machines. This campaign involved 11 malicious extensions distributed across various accounts, with some gaining over 17,000 downloads before being removed by platforms. In response, Microsoft has implemented secrets scanning and blocking capabilities to prevent the publication of extensions containing sensitive data. Despite these measures, alternative marketplaces such as Open VSX still lack robust security protocols, making them vulnerable to continued malicious use. To mitigate these risks, security experts recommend developers thoroughly sanitize their code before publishing and organizations should maintain extension allowlists and inventories. By adopting these strategies and carefully vetting extensions, developers and users can better protect themselves from potential security breaches. --- Tags: [#devtools](https://daily.dev/tags/devtools), [#malware](https://daily.dev/tags/malware), [#security](https://daily.dev/tags/security), [#supply-chain](https://daily.dev/tags/supply-chain), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/security-risks-in-vscode-extensions-tigerjack-and-more-tcd4jpiqu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Security Risks in VSCode Extensions: TigerJack and More","url":"https://daily.dev/posts/security-risks-in-vscode-extensions-tigerjack-and-more-tcd4jpiqu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/security-risks-in-vscode-extensions-tigerjack-and-more-tcd4jpiqu"},"datePublished":"2025-10-15T15:43:39.120Z","dateModified":"2026-03-15T04:10:04.669Z","description":"Security researchers discovered over 550 leaked secrets in VS Code extensions affecting 185,000+ installations, including API keys for AI platforms, AWS, GCP,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/488353b951a8b7afd42a4cf754da9596?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/488353b951a8b7afd42a4cf754da9596?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/security-risks-in-vscode-extensions-tigerjack-and-more-tcd4jpiqu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools,malware,security,supply-chain,vscode","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Security Risks in VSCode Extensions: TigerJack and More"}]} ```