VSMEx: A Collection Tool and a Dataset of Malicious VS Code Extensions: Data/Toolset Paper

Abstract

Visual Studio Code (VS Code) is one of the most widely used code editors, and its extension ecosystem has increasingly become a target for software supply chain attacks. Developing and validating effective detection techniques in this area requires ground-truth data with both benign and malicious samples. While benign samples are easy to obtain, no publicly available or continuously updated dataset exists for malicious VS Code extensions. To address this gap, we built VSMEx, a continuously updated dataset of malicious VS Code extensions derived from Microsoft's official malicious and removed lists. Over a deployment period of more than three months, VSMEx successfully captured 214 extensions, demonstrating the viability of our approach. In this work, we present an initial analysis of the resulting dataset and share the associated metadata and the list of flagged or removed extensions collected during this period. In addition, we provide controlled access to the dataset itself, facilitating further research and contributing to the security of the VS Code ecosystem. Note that VSMEx continues to operate, making the resulting dataset well suited for training and validation in continuous machine learning settings.

Authors 5

1. Kotaiba Alachkar

   Delft University of Technology

   Affiliation as printed

   TU Delft, Delft, Netherlands

2. Dirk Gaastra
   Affiliation as printed

   Independent Researcher, Amstelveen, Netherlands

3. Olga Gadyatskaya Aachen

   Leiden University

   Affiliation as printed

   Leiden University, Leiden, Netherlands

4. Michel J. G. van Eeten

   Delft University of Technology

   Affiliation as printed

   TU Delft, Delft, Netherlands

5. Yury Zhauniarovich

   Delft University of Technology

   Affiliation as printed

   TU Delft, Delft, Netherlands