Editor Extension Process Reading .git/config or .git/HEAD Files

Duo Tech@duotech

•updated Aug 5, 2026•1•0•6

Detects a code editor process (VS Code, VS Code Insiders, code-server) opening or reading the .git/config or .git/HEAD file, which may indicate a malicious editor extension harvesting private repository and CI/CD configuration data, as seen in the Open VSX "evil twin" extension campaign.