🤖 AI Summary
This study identifies a critical security vulnerability in the VS Code extension ecosystem: cross-extension interactions can lead to unauthorized leakage of sensitive data—including passwords and API keys. To address this, we propose the first automated risk detection framework specifically designed for VS Code extensions, integrating static program analysis, NLP-driven interpretation of configuration files and documentation, API call graph construction, and fine-grained sensitive data flow tracking. We conduct a large-scale empirical evaluation across 27,261 real-world extensions and, for the first time, quantify that 8.5% (2,325) exhibit credential-level leakage risks—spanning multiple attack vectors such as command invocation, user input handling, and configuration file reading. This work constitutes the first systematic, large-scale empirical study on IDE extension security, establishing both a methodological foundation and empirical evidence to guide secure plugin ecosystem governance.
📝 Abstract
Recent years have witnessed the emerging trend of extensions in modern Integrated Development Environments (IDEs) like Visual Studio Code (VSCode) that significantly enhance developer productivity. Especially, popular AI coding assistants like GitHub Copilot and Tabnine provide conveniences like automated code completion and debugging. While these extensions offer numerous benefits, they may introduce privacy and security concerns to software developers. However, there is no existing work that systematically analyzes the security and privacy concerns, including the risks of data exposure in VSCode extensions. In this paper, we investigate on the security issues of cross-extension interactions in VSCode and shed light on the vulnerabilities caused by data exposure among different extensions. Our study uncovers high-impact security flaws that could allow adversaries to stealthily acquire or manipulate credential-related data (e.g., passwords, API keys, access tokens) from other extensions if not properly handled by extension vendors. To measure their prevalence, we design a novel automated risk detection framework that leverages program analysis and natural language processing techniques to automatically identify potential risks in VSCode extensions. By applying our tool to 27,261 real-world VSCode extensions, we discover that 8.5% of them (i.e., 2,325 extensions) are exposed to credential-related data leakage through various vectors, such as commands, user input, and configurations. Our study sheds light on the security challenges and flaws of the extension-in-IDE paradigm and provides suggestions and recommendations for improving the security of VSCode extensions and mitigating the risks of data exposure.