• EverythingDevOps
  • Posts
  • Weekend RoundUp: Malicious VS Code Extensions Target Developers

Weekend RoundUp: Malicious VS Code Extensions Target Developers

Two extensions were caught stealing sensitive data, and here is what you need to know.

AuthorAuthor

Gloria & Divine Odazie
December 12, 2025

In partnership with

The Tech newsletter for Engineers who want to stay ahead

Tech moves fast, but you're still playing catch-up?

That's exactly why 100K+ engineers working at Google, Meta, and Apple read The Code twice a week.

Here's what you get:

  • Curated tech news that shapes your career - Filtered from thousands of sources so you know what's coming 6 months early.

  • Practical resources you can use immediately - Real tutorials and tools that solve actual engineering problems.

  • Research papers and insights decoded - We break down complex tech so you understand what matters.

All delivered twice a week in just 2 short emails.

Hey there,

Happy FridayšŸ„³!

Before you wrap the week, hereā€™s a quick drop of things worth checking out.

šŸ“°Top Picks:

Google Adds Second AI Model to Chrome for Safety
Google is introducing a second Gemini-based model in Chrome to monitor its first AI agent, preventing risky actions from malicious content. The new ā€œUser Alignment Criticā€ checks agent decisions and blocks unsafe tasks. Read more.

AWS Introduces Database Savings Plans
AWS launched Database Savings Plans with discounts up to 35 percent across Aurora, DynamoDB, and more, without locking customers to an engine or region. Early reactions say this signals where AWS is heading for future database commitments. Read more.

Coder Introduces AI Development Infrastructure
Coderā€™s latest release adds centralized AI access, agent level permissions, and a stronger automation engine. Together, they create a secure foundation for hybrid development where both humans and AI agents operate under consistent safeguards. Read more.

Anthropic Acquires Bun to Boost AI Coding Tools
Anthropic has acquired Bun, the high-performance JavaScript toolkit, to speed up Claude Code, keeping it open source. The move follows Claude Codeā€™s $1B annualized revenue run rate. Read more.

Malicious VS Code Extensions Target Developers
Two VS Code extensions posing as a theme and AI tool were found stealing WiFi passwords, clipboard data, and browser sessions. Microsoft removed the extensions after discovery. Read more.

JetBrains Shuts Down Fleet IDE
JetBrains will discontinue its Fleet IDE on December 22, 2025, shifting focus to Air, a new agentic AI development tool built on the Fleet platform. Air guides developers via AI agents and is now in public preview. Read more.

Critical React Flaw Lets Hackers Run Code Remotely
A severe vulnerability in React Server Components and Next.js allows attackers to execute code on affected servers. Companies are strongly urged to patch immediately. Read more.

Linux Foundation Forms Agentic AI Foundation
The Linux Foundation has launched the Agentic AI Foundation to provide neutral oversight for AI agent infrastructure, uniting projects from Anthropic, OpenAI, and Block. The effort aims to ensure transparency and stability as agentic tools expand. Read more.

AWS Resurrects CodeCommit
AWS reopens CodeCommit to new users, with Git LFS coming in 2026. The managed Git service simplifies compliance and integrates with CodePipeline and CodeBuild. Read more.

Microsoft Closes 2025 With Critical Patches
Microsoft released fixes for 56 Windows flaws, including an actively exploited zero-day in Cloud Files minifilter and two command injection vulnerabilities in PowerShell and GitHub Copilot for JetBrains. All users are urged to patch immediately. Read more.

Was this email forwarded to you? Subscribe here to get your weekly updates directly into your inbox.

GenAI Security: Defending Against Deepfakes and Automated Social Engineering

šŸŽ§ Your Friday listen: Wes Reisz and Shuman Ghosemajumder, CEO of Reken, explore how deepfakes and automated social engineering are scaling cybercrime.

open.spotify.com/episode/4WgvSeqEQAynjQttxjmvT1?si=5ffff8b39d2246ce

Turn AI Into Your Income Stream

The AI economy is booming, and smart entrepreneurs are already profiting. Subscribe to Mindstream and get instant access to 200+ proven strategies to monetize AI tools like ChatGPT, Midjourney, and more. From content creation to automation services, discover actionable ways to build your AI-powered income. No coding required, just practical strategies that work.

šŸ—“ļø Upcoming Events

Mark your calendars!

  • DevFest Sri Lanka 2025 (14 December)
    Sri Lankaā€™s premier developer conference brings together local and international tech experts to share insights on AI, cloud, mobile, and web technologies, with interactive workshops and community sessions. Get your tickets.

  • DevFest Kigali 2025 (19ā€“20 December)
    Two days of tech exploration in Kigali featuring talks, workshops, and hackathons on cloud, mobile, AI, and web technologies, designed to connect developers across the region. Get your tickets.

  • DevFest Kolkata 2025 (21 December)
    End the year with a one-day developer meetup in Kolkata, covering modern web, cloud, and mobile technologies, interactive coding sessions, and community networking. Get your tickets.

Creating and Enforcing Organization-Wide Policies With Octopus Platform Hub

Octopus Platform Hub lets teams create standard deployment workflows that developers can easily follow. Policies written in Rego run automatically before deployments, making sure security checks and best practices are always applied.

This means teams can move fast without worrying about compliance or operational mistakes. The platform makes it simple to enforce consistency while still giving developers the freedom to work efficiently. Read more.

Opportunities:

Got a sec?
Just two questions. Honest feedback helps us improve. No names, no pressure.

Click here.

And itā€™s a wrap!

If you found this helpful, share this link with a colleague or fellow DevOps engineer.

Have a restful weekend!

Divine Odazie
Founder of EverythingDevOps