VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks
Summary: Microsoft announced that Visual Studio Code will apply a two-hour delay before automatically updating extensions to newer versions, a feature available starting in VS Code 1.123. The delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI, which continue to update immediately, and users can still update any extension at any time using the "Update" button.
What's compelling: The two-hour window is meant to limit exposure to a compromised release before registry maintainers can flag and remove it, but extensions from Microsoft, GitHub, and OpenAI skip the delay entirely - so the protection depends on how much of your extension set comes from those publishers.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026