TLDR Tech / InfoSec
After the VS Code Supply Chain Attack: Is Your Extension Blocking Actually Working?
When a user tries to install a VS Code extension from the marketplace, VS Code first contacts marketplace.visualstudio.com to obtain the CDN URL that actually serves the extension and then it is extracted and installed. Many organizations only blocked the marketplace URL when putting in place extension blocks which could be circumvented by an attacker that knows or can reconstruct the CDN URL. Restricting users from installing extensions can also fall short if an attacker were to directly extract the extension into .vscode\extension\.
Read the full story