---
title: "Discussion on \"How a Malicious VSIX Uses the Signed Editor Runtime\" | Hashnode"
description: "Discussion on \"How a Malicious VSIX Uses the Signed Editor Runtime\". How a fake Google Update Support extension installs its components and runs the editor's own Electron binary as a Node interpreter."
url: "https://hashnode.com/posts/vsix-editor-execution/6ae835efaecf55aa7e9d0c27"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How a Malicious VSIX Uses the Signed Editor Runtime](https://unk-deaddrop.hashnode.dev/vsix-editor-execution?utm_source=hashnode&utm_medium=feed)

How a fake Google Update Support extension installs its components and runs the editor's own Electron binary as a Node interpreter.

Nov 2 · 8 min read · unk-deaddrop.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#vscode-extensions](https://hashnode.com/tag/vscode-extensions)
-   [#malware](https://hashnode.com/tag/malware)
-   [#electron](https://hashnode.com/tag/electron)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)

## Written by

[Ilja Krasnjanski](https://hashnode.com/@iljakrasnjanski)

@iljakrasnjanski · Berlin

  
[View profile](https://hashnode.com/@iljakrasnjanski)

Independent security researcher and systems engineer based in Berlin. Author of UNK\_DeadDrop and unk-scanner. I write about static AST analysis, software supply-chain security, and low-level runtime internals. Currently open to full-time roles in security research, static analysis tooling, or systems engineering.

## Responses 1

Markdown supported · ⌘↵ to post

[Damiano Bianda](https://hashnode.com/@damianobianda)

[Nov 2](https://hashnode.com/posts/vsix-editor-execution/6ae835efaecf55aa7e9d0c27/comment/6ae864a358c8411fbc95cd2f)

One detection angle worth adding: ELECTRON\_RUN\_AS\_NODE is a documented Electron feature, so any editor process launched with that variable set is a cheap, high-signal hunt. It also survives the masquerade. The publisher name and extension ID can change per campaign, the env var cannot, because the technique breaks without it. The point about preserving the VSIX together with the workspace settings is underrated too: the hash identifies the archive, but the googleUpdateSupport.\* configuration is what tells you where a given installation was actually sending data.