VS Code news and engineering summaries

A recent VS Code Git extension update enabled 'git.addAICoAuthor' by default, automatically adding 'Co-authored-by: Copilot' trailers to commits. This change faced severe community backlash due to privacy concerns, lack of transparency, and reports of the trailer being injected even when Copilot features were disabled or not used, leading to widespread dissatisfaction among developers.

A vulnerability in VSCode’s webview security allows for unauthorized GitHub token exfiltration. By exploiting keydown events within webviews, an attacker can trick users into installing malicious extensions via linked repositories. This flaw enables access to private repositories and full code execution. Users are advised to clear browser site data for github.dev to mitigate risks.

GitHub confirmed a breach of approximately 3,800 internal repositories after an employee installed a malicious VS Code extension. The company contained the incident, removing the trojanized plugin. While the hacker group TeamPCP has claimed responsibility and attempted to sell the stolen data, GitHub states there is no evidence that customer data was compromised.

Microsoft has introduced a mandatory two-hour delay for automatic VS Code extension updates to mitigate software supply chain risks. This safety measure, which exempts trusted publishers like Microsoft and OpenAI, mirrors similar timing-based controls recently adopted by package managers like npm, pnpm, and RubyGems to prevent the spread of malicious code.

Google transitioned from a fragmented IDE ecosystem to a unified, web-based platform called Cider, eventually leveraging the VSCode frontend. By integrating internal monorepo tools with a powerful remote backend, Google achieved high productivity and enabled rapid deployment of AI-driven developer features, demonstrating the significant leverage gained by standardizing on a single, extensible IDE.

Microsoft warns of a phishing campaign targeting developers with fake Next.js job assessments. The attack uses VS Code workspace automation, npm build tasks, and backend scripts to install backdoors and exfiltrate credentials. Attackers leverage social engineering to compromise developer machines, gaining access to cloud secrets, tokens, and source code.

Dirac is an open-source coding agent that topped the Terminal-Bench-2 leaderboard with 65.2% accuracy. By utilizing hash-anchored edits and AST-native precision, it reduces API costs by 64.8% compared to competitors. Dirac offers high-bandwidth context curation and multi-file batching, enabling efficient, automated refactoring within VS Code or via CLI.

Cherri is a programming language designed to build complex, maintainable Apple Shortcuts. It offers a CLI, VSCode extension, and macOS IDE, supporting features like package management, type checking, and function scoping. By compiling to runnable Shortcuts, it improves development efficiency and reproducibility compared to building within the Shortcuts app directly.

Jamf Threat Labs has identified a new evolution in the Contagious Interview campaign by North Korean threat actors, targeting developers through malicious Visual Studio Code configurations. By tricking users into trusting a cloned repository, attackers abuse tasks.json files to execute malicious JavaScript payloads and establish backdoors for remote code execution. This campaign demonstrates a shift toward abusing legitimate developer tools and workflows to bypass security and maintain persistence on victim systems.

The author streamlined their blog's image workflow by automating Excalidraw exports. After struggling with manual exports and slow GitHub Actions, they customized the Excalidraw VSCode extension to automatically generate light and dark mode SVGs whenever a frame named with the 'export_' prefix is updated, enabling seamless local live previews and faster content creation.

This report details a significant security and billing bypass vulnerability within the Copilot Chat extension for VS Code. The exploit leverages the architectural implementation of subagents and tool calls, which do not currently consume premium request credits. By initiating a session with a free model like GPT-5-mini and defining a custom agent configured to use a premium model such as Claude Opus 4.5, users can orchestrate 'free' premium model usage. The vulnerability allows the free orchestrator model to trigger expensive subagent calls indefinitely. Furthermore, the analyst identifies potential for automated loops and a lack of server-side API validation for message types, suggesting a broader risk of service abuse. Despite being reported to Microsoft Security Response Center, the issue was deemed out of scope for security rewards and redirected to public bug tracking.

VisualJJ is an innovative extension for Visual Studio Code designed to simplify version control by integrating Jujutsu (JJ) with Git and GitHub. It provides a visual, interactive change tree that allows engineers to stay in their creative flow while managing complex versioning tasks. The tool enables users to rebase and reshape commit history through drag-and-drop actions, significantly reducing the anxiety associated with traditional Git operations. Furthermore, VisualJJ streamlines conflict resolution by treating conflicts as part of the draft state, allowing for step-by-step fixes. By integrating pull-request tracking directly within the editor, it creates a seamless transition from local development to production, enhancing overall developer productivity and confidence.

The MSPM0 SDK is a comprehensive software development kit for the MSPM0 microcontroller platform. It provides essential tools, documentation, and device support for high-performance, low-power 32-bit Arm Cortex-M0+ applications. The ecosystem includes IDEs like Code Composer Studio, configuration tools like SysConfig, and migration support, simplifying development and enabling modular, portable code across the MSPM0 series.

mdv is a lightweight Markdown superset designed for creating documents, dashboards, and slides. It adds YAML front-matter, fenced blocks for charts and stats, and simple containers for layouts. Renders include self-contained HTML and PDF outputs, supported by a CLI and a VS Code extension for live previewing. It avoids complex code, focusing on style-driven document rendering.

Swift is expanding its IDE support by launching the official Swift extension on the Open VSX Registry. This enables developers to use the Swift extension in editors like Cursor, VSCodium, and other LSP-compatible IDEs, bringing features like code completion, debugging, and Swift Package Manager support to macOS, Linux, and Windows environments.

The author shares a method for achieving seamless remote development on FreeBSD using Visual Studio Code's Remote SSH extension. By leveraging FreeBSD's Linuxulator to run Linux binaries, they overcome platform incompatibility, replacing slow NFS/SSHFS setups with a high-performance workflow that supports ARM64 environments and VS Code extensions flawlessly.

Nogic is a powerful extension designed for VSCode that allows developers to visualize their codebase structure through interactive diagrams. By automatically indexing the project, the tool provides a unified view of files, classes, and functions within a hierarchical graph. Key features include the creation of custom boards for focused analysis, detailed class diagrams showing inheritance, and call graphs for tracing function dependencies. With real-time auto-sync, any changes made to the code are instantly reflected in the visualization. This tool enhances productivity by helping engineers navigate complex architectures and understand relationships within their software projects more effectively.

AI Avatar is a free tool animating VRM 3D avatars via AI chat integration. Recent updates include support for Gemini API and local LLMs via Ollama, along with generative AI cheering messages. Furthermore, the newly revamped Animation Editor Hyper simplifies 3D animation with a full-tab interface, bone trails, multi-view displays, and VRMA export capabilities for improved usability.

The author recounts a nearly 30-year journey navigating text editors, from initial experiences with Vim and Emacs to VSCode and IntelliJ. Rediscovering Emacs via Doom Emacs, the author finds it invaluable for remote development across diverse machines. Despite modern alternatives, Emacs remains a terminal-based productivity powerhouse, specifically when combined with LSP and tree-sitter integration.

This ESP32-powered capacitor alarm clock is a creative, albeit dangerous, project inspired by ElectroBOOM. It features a custom PCB, web-based settings, and an OLED display. The device intentionally triggers capacitor explosions as an alarm, requiring careful handling and specific hardware choices to function as a high-effort, practical joke.