IDE Extensions

Evidence: IDE Extensions
Description: Collect installed IDE extension and plugin metadata
Category: Applications
Platform: macos
Short Name: ideext
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

IDE extensions execute with the same privileges as the developer’s editor and can read workspace files, access credentials, exfiltrate code, inject backdoors into builds, and persist across sessions. Malicious VS Code-compatible extensions and JetBrains plugins are a proven initial-access and persistence vector.

This collector gathers structured metadata about installed IDE extensions and plugins, including identity, publisher, version, activation events, marketplace provenance, install scripts, and directory or manifest mismatches that suggest tampering. VS Code-compatible results are recorded in ide_extensions_vscode; JetBrains results in ide_extensions_jetbrains.

This collector scans per-user IDE extension directories for VS Code-compatible editors (VS Code, Insiders, Server, Cursor, Devin, Windsurf, VSCodium, Antigravity) and JetBrains IDEs. It parses package.json manifests and plugin.xml metadata without executing extension code. For JetBrains JAR plugins, it reads META-INF/plugin.xml from the archive.

Extension metadata reveals unauthorized, sideloaded, or tampered extensions; broad activation events indicating startup persistence; missing marketplace provenance; directory and manifest identity mismatches suggesting post-install modification; and extension dependency chains that may introduce transitive supply-chain risk.