{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T17:00:10Z","timestamp":1781283610725,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":37,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,6,23]]},"DOI":"10.1145\/3800506.3803487","type":"proceedings-article","created":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T16:24:42Z","timestamp":1781281482000},"page":"138-144","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["VSMEx: A Collection Tool and a Dataset of Malicious VS Code Extensions: Data\/Toolset Paper"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-5138-3833","authenticated-orcid":false,"given":"Kotaiba","family":"Alachkar","sequence":"first","affiliation":[{"name":"TU Delft, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-2586-3281","authenticated-orcid":false,"given":"Dirk","family":"Gaastra","sequence":"additional","affiliation":[{"name":"Independent Researcher, Amstelveen, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3760-9165","authenticated-orcid":false,"given":"Olga","family":"Gadyatskaya","sequence":"additional","affiliation":[{"name":"Leiden University, Leiden, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7878-2514","authenticated-orcid":false,"given":"Eduardo","family":"Barbaro","sequence":"additional","affiliation":[{"name":"TU Delft, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0338-2812","authenticated-orcid":false,"given":"Michel","family":"van Eeten","sequence":"additional","affiliation":[{"name":"TU Delft, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9116-0728","authenticated-orcid":false,"given":"Yury","family":"Zhauniarovich","sequence":"additional","affiliation":[{"name":"TU Delft, Delft, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Ori Abramovsky. 2023. VSCode security: malicious extensions detected- more than 45 000 downloads- PII exposed and backdoors enabled. https:\/\/blog.checkpoint.com\/securing-the-cloud\/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors\/. Check Point (May 2023)."},{"key":"e_1_3_2_1_2_1","unstructured":"Lawrence Abrams. 2025. Microsoft warns of new xcsset macos malware variant targeting xcode devs. https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-warns-of-new-xcsset-macos-malware-variant-targeting-xcode-devs\/. BleepingComputer (Sept. 2025)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2903508"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3664649"},{"key":"e_1_3_2_1_5_1","unstructured":"CISA. 2025. Widespread supply chain compromise impacting npm ecosystem. https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/09\/23\/widespread-supply-chain-compromise-impacting-npm-ecosystem. U.S. Department of Homeland Security (Sept. 2025)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3374664.3375724"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.23055"},{"key":"e_1_3_2_1_8_1","volume-title":"Open vsx registry v0.26.0: extensions for vs code compatible editors","author":"Foundation Eclipse","year":"2025","unstructured":"Eclipse Foundation. 2025. Open vsx registry v0.26.0: extensions for vs code compatible editors. https:\/\/open-vsx.org\/. (2025)."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3638552"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102399"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00135"},{"key":"e_1_3_2_1_12_1","unstructured":"Jossef Harush Kadouri. 2023. Vs code marketplace api: list all extensions and download artifacts. GitHub Gist. (2023). https:\/\/gist.github.com\/jossef\/8d7681ac0c7fd28e93147aa5044bc129."},{"key":"e_1_3_2_1_13_1","unstructured":"Sean Iyer. 2025. Security and trust in visual studio marketplace. https:\/\/developer.microsoft.com\/blog\/security-and-trust-in-visual-studio-marketplace. (2025)."},{"key":"e_1_3_2_1_14_1","unstructured":"Jetbrains. 2025. Intellij idea. https:\/\/www.jetbrains.com\/idea\/. (2025)."},{"key":"e_1_3_2_1_15_1","volume-title":"EMBER2024 - A benchmark dataset for holistic evaluation of malware classifiers. In Proc. of KDD, 5516-5526","author":"Joyce Robert J","year":"2025","unstructured":"Robert J Joyce, Gideon Miller, Phil Roth, Richard Zak, Elliott Zaresky-Williams, Hyrum Anderson, Edward Raff, and James Holt. 2025. EMBER2024 - A benchmark dataset for holistic evaluation of malware classifiers. In Proc. of KDD, 5516-5526."},{"key":"e_1_3_2_1_16_1","unstructured":"Koi Security. 2025. Koidex. https:\/\/dex.koi.security\/. (2025)."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103134"},{"key":"e_1_3_2_1_18_1","volume-title":"version 1.35.1, released september 12","year":"2025","unstructured":"Microsoft. 2025. Azure-core, version 1.35.1, released september 12, 2025. https:\/\/pypi.org\/project\/azure-core\/1.35.1\/. (2025)."},{"key":"e_1_3_2_1_19_1","volume-title":"version 12.26.0, released july 16","year":"2025","unstructured":"Microsoft. 2025. Azure-storage-blob, version 12.26.0, released july 16, 2025. https:\/\/pypi.org\/project\/azure-storage-blob\/12.26.0\/. (2025)."},{"key":"e_1_3_2_1_20_1","unstructured":"Microsoft. 2025. Extension manifest reference. https:\/\/code.visualstudio.com\/api\/references\/extension-manifest. (2025)."},{"key":"e_1_3_2_1_21_1","unstructured":"Microsoft. 2025. Extension runtime security. https:\/\/code.visualstudio.com\/docs\/configure\/extensions\/extension-runtime-security. (2025)."},{"key":"e_1_3_2_1_22_1","unstructured":"Microsoft. 2026. PublishedExtensionFlags enum. (2026). https:\/\/learn.microsoft.com\/en-us\/javascript\/api\/azure-devops-extension-api\/publishedextensionflags."},{"key":"e_1_3_2_1_23_1","unstructured":"Microsoft. 2025. Visual studio code. https:\/\/code.visualstudio.com\/. (2025)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3417978"},{"key":"e_1_3_2_1_26_1","volume-title":"Kenneth and contributors","author":"Reitz","year":"2025","unstructured":"Reitz, Kenneth and contributors. 2025. Requests, version 2.32.5, released august 18, 2025. https:\/\/pypi.org\/project\/requests\/. (2025)."},{"key":"e_1_3_2_1_27_1","volume-title":"The 2025 software supply chain security report. https:\/\/www.reversinglabs.com\/sscs-report. ReversingLabs","year":"2025","unstructured":"ReversingLabs. 2025. The 2025 software supply chain security report. https:\/\/www.reversinglabs.com\/sscs-report. ReversingLabs (2025)."},{"key":"e_1_3_2_1_28_1","unstructured":"ReversingLabs Threat Research. 2025. Spectra assure community. https:\/\/secure.software\/. (2025)."},{"key":"e_1_3_2_1_29_1","unstructured":"Seraphic Security. 2025. Browsertotal. https:\/\/browsertotal.com\/. (2025)."},{"key":"e_1_3_2_1_30_1","unstructured":"Amanda Silver. 2025. Celebrating 50 million developers: the journey of Visual Studio and Visual Studio Code. https:\/\/devblogs.microsoft.com\/blog\/celebratin g-50-million-developers-the-journey-of-visual-studio-and-visual-studio-code. Microsoft (May 2025)."},{"key":"e_1_3_2_1_31_1","unstructured":"ssbarnea. 2021. Document marketplace api. GitHub Issue. (2021). https:\/\/github.com\/microsoft\/vsmarketplace\/issues\/238."},{"key":"e_1_3_2_1_32_1","volume-title":"Stack Overflow Developer Survey","author":"Overflow Stack","year":"2025","unstructured":"Stack Overflow. 2025. Stack Overflow Developer Survey 2025. https:\/\/survey.stackoverflow.co\/2025. (2025)."},{"key":"e_1_3_2_1_33_1","unstructured":"Stack Overflow Contributors. 2022. How to programmatically retrieve the list of visual studio code extensions on the marketplace? Stack Overflow. (2022). https:\/\/stackoverflow.com\/questions\/71742538."},{"key":"e_1_3_2_1_34_1","unstructured":"Stack Overflow Contributors. 2021. How to use contains in visual studio code extensions api? Stack Overflow. (2021). https:\/\/stackoverflow.com\/questions\/66009233."},{"key":"e_1_3_2_1_35_1","volume-title":"Malicious vscode extensions with millions of installs discovered. https:\/\/www.bleepingcomputer.com\/news\/security\/malicious-vscode-e xtensions-with-millions-of-installs-discovered\/. (June","author":"Toulas Bill","year":"2024","unstructured":"Bill Toulas. 2024. Malicious vscode extensions with millions of installs discovered. https:\/\/www.bleepingcomputer.com\/news\/security\/malicious-vscode-e xtensions-with-millions-of-installs-discovered\/. (June 2024)."},{"key":"e_1_3_2_1_36_1","volume-title":"Bit ByBit - emulation of the DPRK's largest cryptocurrency heist. https:\/\/www.elastic.co\/security-labs\/bit-bybit. Elastic Security Labs (May","author":"Wilhoit Colson","year":"2025","unstructured":"Colson Wilhoit and Terrance DeJesus. 2025. Bit ByBit - emulation of the DPRK's largest cryptocurrency heist. https:\/\/www.elastic.co\/security-labs\/bit-bybit. Elastic Security Labs (May 2025)."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3643991.3644883"}],"event":{"name":"CODASPY '26: Sixteenth ACM Conference on Data and Application Security and Privacy","location":"Frankfurt am Main Germany","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy"],"original-title":[],"deposited":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T16:24:58Z","timestamp":1781281498000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3800506.3803487"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,22]]},"references-count":37,"alternative-id":["10.1145\/3800506.3803487","10.1145\/3800506"],"URL":"https:\/\/doi.org\/10.1145\/3800506.3803487","relation":{},"subject":[],"published":{"date-parts":[[2026,6,22]]},"assertion":[{"value":"2026-06-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}