Microsoft Bakes a Two-Hour Quarantine Into VS Code Extension Auto-Updates

Microsoft is adding friction to one of the softer targets in the developer toolchain.

Starting with recent Visual Studio Code builds, extensions configured for automatic updates will sit in a two-hour holding pattern before the new version is pulled down to user machines. The change is documented in the VS Code release notes and framed as a hedge against marketplace-borne supply chain compromise.

The logic is simple. If a malicious extension update lands in the marketplace — whether through a hijacked maintainer account, a stolen publisher token, or a deliberately planted backdoor — there is now a window for Microsoft, security researchers, or the publisher themselves to yank it before it auto-installs across millions of developer endpoints.

Two hours is not a lot. But it is enough.

This is a category of attack that has shifted from theoretical to routine. Compromises tracked across the npm, PyPI, and VS Code Marketplace ecosystems over the past 18 months — including the credential-stealing extensions documented by researchers at ExtensionTotal earlier this year — have repeatedly shown that the gap between malicious publish and mass installation is the critical window. Close it, and you blunt the campaign.

The move parallels broader industry posture. GitHub has rolled out publisher attestation for npm. PyPI now requires 2FA for maintainers of high-traffic projects. The VS Code Marketplace, by contrast, has been comparatively permissive, and prior reporting from ReversingLabs and others has flagged typosquatted and trojanized extensions sitting live for weeks.

A few caveats worth flagging.

The two-hour delay only applies when auto-update is enabled. Manual installs from the marketplace UI bypass the quarantine entirely, which means a socially engineered "install this extension now" lure still works at line speed. Enterprises using the Extension Control policies in managed environments will want to layer allowlisting on top, not treat the delay as a primary control.

There is also no public signal — at least none I have seen — about how Microsoft will use the two-hour window operationally. Is there automated scanning happening in that gap? Reputation scoring? Or is this purely a passive delay that depends on someone, somewhere, noticing and reporting? The distinction matters for how much defensive weight the control can actually carry.

My read: this is a sensible, low-cost mitigation that raises the floor without solving the underlying problem. The VS Code Marketplace still lacks the kind of mandatory publisher verification and signed-provenance pipeline that would meaningfully change the calculus for an attacker willing to burn a publisher account.

Attribution-wise, no specific campaign appears to have triggered the change. But the pattern of marketplace abuse — overlapping TTPs across financially motivated crews and at least one cluster with possible DPRK nexus tooling reported by Socket — has been building for a while. Microsoft is moving with the trend, not ahead of it.