Introducing Package Firewall for VS Code Extensions: Detect and Block Malicious Extensions From the IDE

GitHub’s breach of roughly 3,800 internal repositories after an employee installed a poisoned update to the verified Nx Console VS Code extension highlights how editor extensions can create software supply-chain risks outside traditional dependency controls. Because extensions are not typically included in manifests, lockfiles, SBOMs, or CI scans, can update automatically, and run with developer-level permissions, compromised publishers can distribute credential-stealing or otherwise malicious updates broadly, as illustrated by the GlassWorm campaign. Endor Labs has expanded its Threat Center and Package Firewall products to scan and block unsafe Visual Studio Marketplace extensions and command-line installations before they reach developer machines, while retaining users on the latest known-safe version and logging installation activity. The service can be deployed through existing MDM tools without endpoint agents, wrappers, or certificates, and offers policies to block detected malware, delay newly released versions for review, and permit approved exceptions. The release is positioned as part of broader efforts to secure developer workstations, including governance for AI coding agents, MCP servers, and related tools, and is available to existing Package Firewall customers without an upgrade.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.