Malicious npm packages mimicking Rollup polyfill tooling steal browser data, crypto wallets, and AI tool credentials in a Lazarus-linked campaign.

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Eclipse Open VSX has reached 1.0.0, highlighting its role as a vendor-neutral registry for VS Code-compatible extensions.

VS Code’s secret weapons ...

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...

A GitHub employee installed a routine VS Code extension update on the morning of May 18, 2026. That single action handed cybercrime group TeamPCP enough access to exfiltrate approximately 3,800 of ...

Legitimate Microsoft .NET and Visual Studio processes, including dfsvc.exe and vshost.exe, helped malicious code blend into ordinary Windows activity. One intrusion chain paired a legitimate Sogou ...

This extension does not allow you to debug Java or Processing projects. Installing this extension will add the following commands to your command pallette (CTRL+SHIFT+P, or opened by View -> Command ...

While Microsoft’s plans to fix Windows 11 involve making the experience better for regular users, the company also highlighted improvements for one of the most important parts of its developer ...

There's a lot of buzz around OpenClaw lately, so I had to check it out in my favorite editor, VS Code. Turns out this is a nascent space, not much being done with the new it agentic AI tool and the ...

Microsoft Defender Experts has observed the Contagious Interview campaign, a sophisticated social engineering operation active since at least December 2022. Microsoft continues to detect activity ...