--- title: "When Your IDE Becomes a RCE Endpoint" url: https://daily.dev/posts/when-your-ide-becomes-a-rce-endpoint-fwzhdkz3r source_url: https://medium.com/trendyol-tech/when-your-ide-becomes-a-rce-endpoint-c87b85096b19 type: article source: "Trendyol Tech" published: 2026-06-29T19:23:26.294Z updated: 2026-06-30T00:20:44.109Z tags: ["security"] reading_time: 27 upvotes: 6 comments: 1 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # When Your IDE Becomes a RCE Endpoint **[Trendyol Tech](https://daily.dev/sources/trendyoltech)** · 27 min read · 6 upvotes · 1 comments ## Summary Trendyol's CSOC and Application Security team uncovered a live supply-chain attack technique targeting Cursor, Windsurf, VSCodium, and other VS Code forks that resolve extensions from OpenVSX. Because Microsoft's Marketplace and OpenVSX are separate trust roots with no shared ownership, attackers can register abandoned or unclaimed publisher.extension namespaces on OpenVSX and silently deliver malicious code to any developer using an affected editor. A full comparison of 129,000 Microsoft Marketplace extensions against 14,194 OpenVSX entries revealed 104,456 squat-ready namespaces, 1,078 publisher mismatches, and 126 exact-ID hijacks including high-install extensions like sumneko.lua and rust-lang.rust. The post walks through the full 8-step attack chain, explains how Cursor's June 2025 migration to OpenVSX dramatically expanded the blast radius, and provides CrowdStrike Falcon detection queries using CURSOR_SPAWN* environment variables. Recommended mitigations include enforcing an organization-wide extension allowlist, enabling auto-update cooldowns, auditing installed extensions against OpenVSX ownership, and treating developer endpoints as production-equivalent assets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Bloom Security’s Extension Resurrection research exposes a blind spot in developer security](https://daily.dev/posts/bloom-security-s-extension-resurrection-research-exposes-a-blind-spot-in-developer-security-ww5xzwiek) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/when-your-ide-becomes-a-rce-endpoint-fwzhdkz3r)