Bloom Security Finds ‘Extension Resurrection’ Flaw That Could Enable Zero-Click RCE Across 500,000+ Downloads

New York, USA, August 13th, 2026, FinanceWire

Developer tools have become a growing part of the enterprise attack surface, but the security implications of IDE extensions can be easy to overlook. Bloom Security says it uncovered a supply-chain vulnerability affecting extension packs on both the Visual Studio Code Marketplace and Open VSX that could allow attackers to silently introduce malicious code into previously trusted software bundles.

The company dubbed the technique “Extension Resurrection.” According to Bloom, attackers could claim namespaces associated with extensions that were referenced by existing extension packs but did not actually exist on the marketplace, publish malicious versions under those names, and have them installed automatically when users installed or updated the trusted pack.

Bloom found more than 750 affected extension packs across the two marketplaces, with aggregated downloads exceeding 500,000. Because VS Code extensions and compatible IDE extensions can access the host through Node.js, Bloom characterized the result as remote code execution delivered through a trusted installation path.

How the Attack Worked

Extension packs allow developers to install multiple tools through a single package. A developer might install a pack containing a linter, formatter, debugger and test runner without separately evaluating each extension it includes.

The problem emerged when a pack referenced an extension that was not actually present on the marketplace. Bloom refers to these as “Shadow Dependencies,” dangling references inside trusted bundles that point to extensions that do not exist.

The company scanned extension packs on both marketplaces and found 94 of 321 packs on Open VSX contained at least one shadow dependency. On the VS Code Marketplace, 677 of 4,179 extension packs had at least one such dependency, including 60 where the referenced publisher was not registered.

Bloom then tested whether those empty namespaces could be claimed. On Open VSX, it attempted to recreate the prettify-json extension in the mohsen1 namespace. Although the marketplace initially rejected the attempt because its index retained a phantom reference, Bloom found that increasing the version number allowed the extension to be published.

Once published, the previously unresolved dependency pointed to the newly created extension.

The Zero-Click Problem

The significance of the flaw was not simply that an attacker could publish a malicious extension. The bigger issue was how the extension reached victims.

When a user installed an affected extension pack, the malicious extension could be installed alongside the trusted components without a separate prompt or additional click. Existing users could also be exposed through automatic updates because extension packs do not pin their bundled extensions to specific versions.

Bloom described the potential impact as particularly significant because developers often have access to sensitive resources, including source code repositories, cloud credentials, deployment pipelines and internal tooling.

Two Marketplace Gaps

Bloom identified two underlying weaknesses. First, marketplaces allowed extension packs to reference extensions that did not exist, leaving behind phantom dependencies. Second, namespaces could be registered even when they were referenced by existing software.

On Open VSX, Bloom said the same issue also affected extension dependencies declared within extension manifests, expanding the potential attack surface beyond extension packs.

The company reported the issue to the Eclipse Foundation’s Open VSX team on February 5, 2026. The team assigned at-risk namespaces to the open-vsx account and implemented checks preventing the publication of packs containing nonexistent bundled extensions or dependencies.

Bloom reported the issue to Microsoft’s MSRC on February 17, 2026. Microsoft initially assessed it as Moderate severity before reopening the case after Bloom provided additional evidence. Microsoft subsequently confirmed that its extension resurrection prevention had been implemented in stages, with protections for admin actions beginning in October 2025 and user actions in June 2026.

What Organizations Should Watch

The discovery highlights a broader challenge for security teams: knowing what developers have installed is not necessarily enough. Organizations also need visibility into extension packs, their bundled dependencies, update configurations and the security posture of individual extensions.

Bloom recommends treating extension packs as part of the enterprise threat model rather than assuming the pack itself represents a complete trust decision. Marketplace operators, meanwhile, can reduce the risk by validating that referenced extensions exist and protecting namespaces associated with published software.

For developers, the central lesson is that an installation made months or years ago may not remain static. As Bloom puts it, “install once” does not necessarily mean “static forever”—particularly when automatic updates are enabled.

Contact