Poisoned Pipeline

Poisoned Pipeline / Techniques / T0154

T0154 · Initial Access · TA03 · observed in 18 incident(s)

Malicious IDE extension

Open Source Security

Malicious IDE extension attack is an attack technique in which an attacker creates a malicious extension for an Integrated Development Environment (IDE) and uploads it to the IDE's extension marketplace or repository.
The malicious extension may appear to be a legitimate tool or add-on, but when installed, it can perform unauthorized actions such as stealing user credentials or introducing vulnerabilities in the code.
Once installed, a malicious IDE extension can access the developer's code, which can contain sensitive information such as access keys, passwords, and credentials.
This information can then be used by the attacker to gain unauthorized access to cloud resources, steal data, or launch further attacks.

Where this idea came from

Security research

DarkGPT, Nx Console; DEF CON 34: “Install Me Maybe” (claimable extension IDs) and “LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails” (Donenfeld) extend the class; Donenfeld’s bio notes CI/CD supply-chain findings in Microsoft, SAP, Red Hat, Linux Foundation projects.

Mitigations

Detections

Observed in incidents (18)

References