VSCode Extension GitHub API Query after Installation

Ethan Andrews@eandrews

•updated Jun 3, 2026•13•0•38

Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.