Non-Git Process (Editor Extension Host) Reading .git/HEAD or Ref Files

Duo Tech@duotech

•updated Aug 5, 2026•1•0•6

Detects non-git processes such as VS Code, VS Code Server, or Node.js reading .git/HEAD or .git/refs files, which may indicate a malicious editor extension harvesting git repository metadata (branch names, commit refs) as observed in the Open VSX 'evil twin' extension campaign.