Unverified85% confidenceFactTime unknown
VS Code扩展市场和npm生态中已多次出现伪装成实用工具的恶意插件事件，部分插件在后台静默窃取环境变量、SSH密钥和API凭证
1
Sources
85%
Confidence
Long-term
Relevance
6/1/2026
First Seen
Sources
Related Entities
Related Claims
Unverified历史上已有多起通过恶意VS Code扩展窃取开发者凭证的安全事件被报告69% similarUnverified开源模式带来商业化路径受限的挑战，且恶意用户可以研究代码寻找漏洞68% similarUnverifiedDirectly executing Skill code downloaded from the internet or autonomously generated by an agent in the host environment poses security risks, as it may contain dangerous operations such as deleting files, accessing sensitive directories, or launching network attacks.68% similarUnverifiedQR code access carries security risks including replay attacks, session credential leakage due to long-lived tokens, and man-in-the-middle attacks.67% similarUnverified在具备工具调用能力的 Agentic 系统中，一次成功的提示注入可能导致数据泄露、恶意代码执行甚至供应链攻击66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/25172API
curl https://kongchang.com/api/v1/knowledge/claims/25172MCP
get_claim(id=25172)