Visual Studio Code Marketplace
Disclosed Jan 23, 20268 months agoUnverified
MaliciousCorgi: AI coding extensions with 1.5M installs sent source files to China
Koi Security found two VS Code Marketplace extensions advertised as AI coding assistants, installed about 1.5 million times combined, that sent the full contents of every file a developer opened, plus server-requested files, to China-based servers without consent.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Jan 23, 2026 |
| Attack | Supply chain |
| Data exposed | Source code, Credentials and tokens |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
| Source | |
|---|---|
| Malicious AI extensions on VSCode Marketplace steal developer datableepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jan 23 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.