A malicious editor extension tabletop checks whether you can find who has an extension installed, contain affected laptops, rotate what the extension could read, and set rules so it does not happen again. This script runs 45 minutes with three injects and a fictional extension called Acme Linter Pro.
Why developer machines matter
Editor extensions run with the developer's permissions. They can read source files, environment variables, SSH keys and cloud credentials stored on disk. Auto updates mean a trusted extension can change overnight. Yet few teams keep an inventory of what is installed, so scope questions are slow.
Setup
- Facilitator, scribe, an IT or endpoint owner, a developer lead, a security lead.
- Premise: version 2.4.0 of Acme Linter Pro, installed by many of your developers, is reported to contain code that uploads local files.
Injects
Inject 1, minute 5. A public report says the latest extension update is malicious. The marketplace listing is still live.
Ask:
- How do you find who has it installed? Do you have any inventory of editor extensions?
- Can you query managed machines? What about personal laptops and contractors?
- Who can tell developers to disable it, and how fast?
Inject 2, minute 18. Forty developers had auto update on. Some had the new version for two days.
Ask:
- What was readable from those machines: repositories, tokens, cloud profiles?
- Which secrets do you rotate first? Who decides?
- How do you handle a laptop you cannot reach?
Inject 3, minute 32. Leadership asks whether source code has left the company.
Ask:
- What evidence could answer that: network logs, endpoint records, repository access logs?
- What can you say today and what must wait?
- Who talks to customers if their code or data was on those machines?
Policy decisions to rehearse
| Decision | Options |
|---|---|
| Install control | Allow list, review queue, or open |
| Updates | Auto, delayed by a few days, or manual |
| Visibility | Inventory by script, device management, or none |
| Secrets on disk | Short lived tokens, a credential helper, or long lived files |
A delay on updates gives the community time to notice a bad release, at the cost of slower security fixes. Discuss which trade-off fits.
Related reading
Walk through how to audit installed editor extensions across a team before the exercise so you can answer inject 1 honestly. For browser equivalents, see approving a browser extension for your company.
Debrief
Pick three fixes, such as a basic inventory script, delayed updates for a trial group and shorter lived credentials, then record them in an after-action report.
Safeguard ships editor integrations for VS Code, JetBrains and Open VSX, as well as browser extensions, and offers policy controls and asset discovery. A free scan covers your repositories.
Quick check
Can we trust extensions from an official marketplace?
A marketplace listing is not a guarantee. Extensions can change after review, so inventory and update rules still matter.
Who should own the extension inventory?
Usually IT or platform engineering with security as a consumer. What matters is that one team owns it and keeps it current.
Last reviewed: 19 October 2026.
