A new investigation by Octri.dev highlights the silent but significant privileges held by VS Code extensions, demonstrating that popular tools like GitLens activate background processes and establish network connections immediately upon editor startup. The study, which monitored 40 distinct VS Code launches on macOS, reveals that extensions using the onStartupFinished activation event can execute code, spawn external executables, and communicate with remote servers before a developer writes a single line of code or opens a specific file.

The Startup Privilege Gap

The core of the analysis focuses on the onStartupFinished activation event, a standard feature in the VS Code extension manifest that allows extensions to initialize automatically when the editor loads. The researchers inspected ten common extensions and found that seven, including Prettier, ESLint, GitLens, EditorConfig, VSCodeVim, Code Spell Checker, and Code Runner, declared this event. This means these tools begin execution without requiring user interaction, a capability that transforms a simple editor launch into a potential attack surface if the extension code is compromised.

GitLens and the GitKraken CLI

While Prettier’s impact was minimal after correcting for measurement errors involving the Copilot Agent Host, GitLens demonstrated substantial background activity. In every test run where GitLens was installed, the monitoring script detected the presence of gk or gk_3_1_79 processes, corresponding to the GitKraken CLI integration. With a Git repository open, the median number of distinct gk process IDs observed rose to five, and in one instance, six distinct processes were recorded during a 90-second session. These processes consumed minimal CPU but significantly increased the memory footprint, adding approximately 87.8 MiB to the primary extension host when a repository was open.

Network Footprints and Supply Chain Risks

The experiment also tracked outbound TCP connections, revealing that GitLens-associated processes established connections to AWS EC2 and Cloudflare endpoints on port 443 in nine out of ten runs. These connections occurred without explicit user commands, driven by features like the GitKraken MCP server integration. The researchers emphasize that while this behavior is documented and legitimate for GitLens, it illustrates the potential for data exfiltration in a supply chain attack. If an attacker compromises a maintainer’s account or release pipeline, malicious code could inherit these same privileges, accessing private repositories, SSH keys, and cloud credentials, then communicating with attacker-controlled infrastructure before the developer notices.

Key Takeaways

  • Activation Events Matter: Seven of ten popular extensions tested use onStartupFinished, meaning they run code automatically when VS Code launches.
  • External Processes Are Common: GitLens spawns GitKraken CLI processes (gk) that consume memory and network resources without direct user input.
  • Network Connections Are Active: Extensions can establish outbound HTTPS connections to remote services like AWS and Cloudflare during idle startup.
  • Workspace Trust Is Not Enough: VS Code’s Workspace Trust feature limits untrusted project code but does not sandbox trusted extensions running with user-level privileges.

The Bottom Line

Editors need to stop treating VS Code extensions as harmless plugins and start auditing them like installed software. If your threat model includes supply chain attacks, the automatic execution privileges granted by onStartupFinished represent a blind spot that requires stricter version pinning and monitoring.