Extension Host Process Enumerating CI/CD Repository Environment Variables
Detects VS Code / Node.js extension host processes invoking command lines that reference CI/CD and repository environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite, CircleCI, Codespace, Gitpod), consistent with malicious Open VSX "evil twin" extensions harvesting developer and CI/CD metadata.
Cortex XDR
