The extension supply chain is the path a code editor add-on takes from its publisher, through an extension registry or marketplace, and onto a developer’s machine. In trusted environments such as VS Code and compatible editors, extensions are often granted broad access to files, commands, terminals, and local secrets, so this path becomes a high-value delivery route.
It matters because attackers can abuse the normal distribution model: they publish a convincing tool, use branding and version changes to appear legitimate, and rely on developers to install it. Once installed, a malicious extension can steal API keys, tokens, browser sessions, or wallet-related data, or prepare the system for further compromise. Defenses focus on supply-chain control: verify publisher identity, restrict installs with allowlists or private marketplaces, review permissions, enable Workspace Trust, and scan for secrets. Treating extension selection as part of security policy helps block threats before code ever runs.