IDE Extensions
Overview
Section titled “Overview”Evidence: IDE Extensions
Description: Collect installed IDE extension and plugin metadata
Category: Applications
Platform: windows
Short Name: ideext
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”IDE extensions execute with the same privileges as the developer’s editor and can read workspace files, access credentials, exfiltrate code, inject backdoors into builds, and persist across sessions. Malicious VS Code-compatible extensions and JetBrains plugins are a proven initial-access and persistence vector.
Data Collected
Section titled “Data Collected”This collector gathers structured metadata about installed IDE extensions and plugins, including identity, publisher, version, activation events, marketplace provenance, install scripts, and directory or manifest mismatches that suggest tampering. VS Code-compatible results are recorded in ide_extensions_vscode; JetBrains results in ide_extensions_jetbrains.
Collection Method
Section titled “Collection Method”This collector scans per-user IDE extension directories for VS Code-compatible editors (VS Code, Insiders, Server, Cursor, Devin, Windsurf, VSCodium, Antigravity) and JetBrains IDEs. It parses package.json manifests and plugin.xml metadata without executing extension code. For JetBrains JAR plugins, it reads META-INF/plugin.xml from the archive.
Forensic Value
Section titled “Forensic Value”Extension metadata reveals unauthorized, sideloaded, or tampered extensions; broad activation events indicating startup persistence; missing marketplace provenance; directory and manifest identity mismatches suggesting post-install modification; and extension dependency chains that may introduce transitive supply-chain risk.