Editor Extension Host Reading devcontainer.json/.vscode/extensions.json (Config-Driven Install Check)

Duo Tech@duotech

•updated Aug 5, 2026•3•0•8

Detects the malicious Open VSX "recon" extension variant checking whether its own extension ID is referenced in the workspace devcontainer.json or .vscode/extensions.json to determine if the install was configuration-driven versus human-initiated