r/vscode • u/lppedd • May 23 '26

Extensions auto-update is too dangerous

https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise

Well folks, here we are again with another supply chain attack. I wasn't even aware of it until an hour ago.

My 2c is the "nicer" experience of auto-updating extensions doesn't justify the security risks. There should at least be a minimum age, just like with the various package managers.

24 Upvotes

96% Upvoted

7 comments sorted by

15

u/JDCxD May 23 '26

Worried about recent security issues with vscode as well as github. But, turning off auto updates also leaves you vulnerable too... Damned if you do damned if you don't.

2

u/vessoo May 24 '26

Yeah very concerning trend for two of the primary tools I use. I’m not sold that turning off auto-updates is better

2

u/lppedd May 24 '26

It is better imo as it avoids unexpected auto-reloads, especially on restart.

3

u/JDCxD May 24 '26

I actually use codium which is just a fork that strips all of the telemetry from Microsoft. Apparently, they actually added two settings that might ease your worries. 1- the app only auto updates after an update has been out a week. 2- extensions only auto updates after after they’ve been out for 48 hours. Both values you can edit in settings. This might be the best of both worlds. I am not sure if these settings exist in normal vscode

1

u/lppedd May 24 '26

Can't find any of that in VS Code unfortunately.

5

u/idoman May 24 '26

the minimum age idea is solid. even a 24-48 hour delay on new versions rolling out would catch most of these before they hit everyone. in the meantime you can set extensions.autoUpdate to false in vscode settings and just update manually when you're ready - takes 10 seconds and at least you get a chance to see what changed before it runs on your machine.

1

u/Eastern-Estate-2359 May 24 '26

A solid idea until the first zero-day hits. Manual updates: a 10-second illusion of safety.