Critical VS Code MCP Vulnerability Exposes Developers to Silent Attacks A newly disclosed vulnerability in Visual Studio Code’s Model Context Protocol (MCP) integration tracked as CVE-2026-41613 allows attackers to execute malicious code or hijack developer sessions with a single click. Discovered by the Oasis Security Research Team, the flaw exploits a hidden trust boundary in VS Code’s MCP install flow, where critical configuration fields are silently persisted without user visibility. ### How the Attack Works MCP, a standard for extending AI coding assistants, enables seamless integration with version control, cloud services, and other developer tools. When users install an MCP configuration via a link, VS Code displays a preview dialog but this interface omits five key fields: environment variables, environment files, HTTP headers, working directory settings, and developer flags. Attackers can embed malicious payloads in these hidden fields, which execute automatically upon installation. Two primary attack vectors were identified: 1. Remote Code Execution (RCE): By injecting malicious environment variables (e.g., `NODE_OPTIONS` with `--import`), attackers gain persistent control over the developer’s machine, surviving reboots. 2. Session Hijacking: Hidden HTTP authorization headers allow attackers to redirect the developer’s AI assistant to operate under their credentials, with no visible authentication prompts. ### Scope and Impact The vulnerability affects VS Code versions prior to 1.119.1, where MCP is natively supported. Since MCP links are commonly shared via GitHub repositories, forums, and documentation, the attack requires no phishing or browser exploits just a single click on a seemingly legitimate link. This incident follows recent disclosures of similar risks in AI tools (e.g., OpenClaw, Claude AI), highlighting a broader pattern: AI assistants, granted broad access to credentials and production systems, rely on thin UI-based trust boundaries that adversaries can exploit. ### Response and Mitigation Microsoft released a patch in VS Code 1.119.1, but organizations must also: - Audit existing MCP configurations for hidden fields (e.g., `env`, `envFile`, `headers`) in `mcp.json` files. - Inventory AI tooling to identify which MCP servers and agents are active across developer environments. - Enforce governance for AI agent identities, treating them with the same rigor as human users (e.g., policy enforcement, audit trails). The incident underscores the expanding attack surface of AI-powered developer tools, where trust in interfaces often outpaces security controls. Most organizations currently lack visibility into what these tools do or on whose behalf.

Nx Console VS Code Extension Compromised in Sophisticated Supply Chain Attack In May 2026, attackers hijacked the widely used Nx Console Visual Studio Code extension, turning it into a credential-stealing tool that exposed millions of developers. The malicious version (18.95.0) of the extension installed over 2.2 million times was published to the official VS Code Marketplace on May 18 using stolen credentials. The attack unfolded in stages, beginning with an earlier breach that compromised a contributor’s GitHub personal access token. At 03:18 UTC, the attacker pushed an orphan commit to the nrwl/nx repository, replacing its contents with just two files: a package.json and an obfuscated index.js payload. By 12:36 UTC, the malicious extension was live, injecting a 2,777-byte backdoor into its main.js file. The payload activated the moment a developer opened any workspace. Within 11 minutes, the Nx team detected and removed the compromised version, but the damage was already done. The malware targeted a broad range of credentials, including tokens from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, as well as Claude AI coding assistant configurations one of the first known supply chain attacks to exploit AI tooling. Stolen data was exfiltrated via HTTPS, GitHub API abuse, and DNS tunneling, ensuring redundancy if one channel was blocked. On macOS, the payload installed a persistent Python backdoor (~/.local/share/kitty/cat.py) that checked in hourly for new commands, signed with a 4096-bit RSA key. The malware also employed anti-analysis techniques, avoiding execution on machines with fewer than four CPU cores or those in Russian/CIS time zones to evade detection. The attack leveraged Sigstore integration, allowing the attacker to forge cryptographically signed npm packages using stolen OIDC tokens, making malicious packages appear legitimate. Security firm StepSecurity confirmed this was the second supply chain incident targeting the Nx ecosystem in a year. Developers who installed version 18.95.0 and opened a workspace between 12:36 and 12:47 UTC on May 18 should assume all credentials on the affected machine were compromised. The Nx team released a patched version (18.100.0) and provided indicators of compromise (IoCs) for detection, including file hashes, Git commit SHAs, and exfiltration endpoints.

Malicious VS Code Extensions Exfiltrate Developer Data to China-Based Servers Cybersecurity researchers have uncovered two malicious Visual Studio Code (VS Code) extensions masquerading as AI-powered coding assistants while secretly harvesting developer data and transmitting it to servers in China. The extensions, still available on the official Visual Studio Marketplace, have amassed a combined 1.5 million installs: - ChatGPT - 中文版 (whensunset.chatgpt-china) – 1.34 million installs - ChatGPT - ChatMoss (CodeMoss) (zhukunpeng.chat-moss) – 151,751 installs Dubbed MaliciousCorgi by Koi Security, the extensions function as advertised providing autocomplete suggestions and code error explanations while covertly exfiltrating data. Every opened file and code modification is encoded in Base64 and sent to a China-based server (aihao123[.]cn) without user consent. The malware also includes a real-time monitoring feature, remotely triggered to exfiltrate up to 50 workspace files per session. Additionally, the extensions embed a hidden zero-pixel iframe loading four Chinese analytics SDKs Zhuge.io, GrowingIO, TalkingData, and Baidu Analytics to fingerprint devices and build detailed user profiles. ### JavaScript Package Managers Vulnerable to Supply Chain Attacks In a separate disclosure, Koi Security identified six zero-day vulnerabilities (collectively named PackageGate) in JavaScript package managers npm, pnpm, vlt, and Bun that bypass security controls designed to prevent malicious script execution during package installation. These flaws undermine defenses like `--ignore-scripts` and lockfile integrity checks, which were introduced after the Shai-Hulud worm exploited postinstall scripts to hijack npm tokens. Following responsible disclosure, fixes were implemented in: - pnpm (v10.26.0) – Tracked as CVE-2025-69264 (CVSS 8.8) and CVE-2025-69263 (CVSS 7.5) - vlt (v1.0.0-rc.10) - Bun (v1.3.5) However, npm has declined to patch the issue, stating that users are responsible for vetting package content. GitHub, npm’s parent company, confirmed it is actively addressing the flaw but emphasized that git dependencies inherently trust repository contents, including configuration files. GitHub has also reinforced supply chain security measures, including deprecating legacy tokens, enforcing shorter expiration for granular tokens, and removing 2FA bypass options for local package publishing. As of September 2025, organizations remain advised to disable scripts and commit lockfiles, though researchers warn these measures alone may not fully mitigate risks until PackageGate is resolved.