Visual Studio Code
Visual Studio Code is Microsoft’s editor for writing, running and checking computer code. It’s made by Microsoft, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from code.visualstudio.com.
What it is
People use Visual Studio Code to write software, build websites and learn programming. It edits project files and includes tools for running code and finding errors. Its AI features are optional, and the basic editor needs no account.
It reads and changes files to work on your projects. Installed extensions have the same permissions as the editor: they can read and write files, connect to the internet and run other programs. Microsoft collects crash, error and usage data; you can turn this off, but extensions may have separate data settings.
This is Microsoft’s own coding tool. Microsoft recommends browsing unfamiliar projects in Restricted Mode and installing extensions only from publishers you trust. Restricted Mode limits automatic code execution, but cannot stop a malicious extension.
Who makes it
Microsoft is a technology company founded in 1975 and based in Redmond, Washington. Its legal name is Microsoft Corporation. Its website is microsoft.com.
Microsoft makes other software with flaws that attackers have used. Its page in Companies lists them.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real Visual Studio Code is signed by Microsoft Corporation, Apple team ID UBF8T346G9. A copy signed by anyone else isn’t from Microsoft. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/Visual Studio Code.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is com.microsoft.VSCode or com.microsoft.VSCodeInsiders or com.microsoft.VSCodeExploration. Download it only from code.visualstudio.com, not from an ad or a link someone sends you.
Fakes. In September 2026, attackers used a fake job interview coding assignment to infect a Sophos employee’s Mac. The project changed VS Code’s terminal settings so opening a terminal downloaded and ran malware; Sophos found that this abused a legitimate feature rather than a software flaw.
What it connects to
In normal use, Visual Studio Code talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
update.code.visualstudio.com | App downloads and updates. |
vscode.download.prss.microsoft.com | App download delivery. |
marketplace.visualstudio.com | Find and install extensions. |
*.gallery.vsassets.io | Extension marketplace content. |
*.gallerycdn.vsassets.io | Extension marketplace downloads. |
vscode-sync.trafficmanager.net | Synchronise settings when enabled. |
raw.githubusercontent.com | Retrieve files from GitHub repositories. |
code.visualstudio.com | Documentation. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Microphone | For optional voice chat and dictation, or programs run through the editor that use audio input. |
| Camera | Can be requested by a program run through the editor that uses the camera. |
| Automation | Can be requested when a program run through its terminal uses AppleScript to control another app. |
| Accessibility | Can be requested by programs run through its terminal that use macOS accessibility controls. |
| Screen Recording | Can be requested by programs run through its terminal that capture the screen. |
Security record
Problems with Visual Studio Code or Microsoft in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| A malicious notebook could steal local files even without trusting its project; Microsoft fixed this in version 1.136.2. | ↗ | |
| Clicking an error notification link created by a malicious project could run commands in Restricted Mode; Microsoft fixed this in version 1.141.1. | ↗ | |
| Opening a project through the agents tunnel web address could skip trust checks and allow attacker-supplied instructions to run; Microsoft fixed this in version 1.141.1. | ↗ | |
| Reusing or restarting an integrated terminal could bypass Restricted Mode’s trust check; Microsoft fixed this in version 1.141.1. | ↗ | |
| A malicious project could bypass warnings for unsafe terminal links in Restricted Mode; Microsoft fixed this in version 1.141.1. | ↗ |
References
- Facts About Microsoft news.microsoft.com
- Get started with Visual Studio Code code.visualstudio.com
- Download Visual Studio Code code.visualstudio.com
- Installing Visual Studio Code on macOS code.visualstudio.com
- Release Notes Archive code.visualstudio.com
- VSCodeVim: macOS configuration identifies stable and Insiders editions github.com
- Does It ARM: recorded Insiders and Exploration bundle identifiers doesitarm.com
- Network Connections in Visual Studio Code code.visualstudio.com
- Extension runtime security code.visualstudio.com
- Workspace Trust code.visualstudio.com
- Telemetry code.visualstudio.com
- Voice support code.visualstudio.com
- macOS permissions for programs run through VS Code github.com
- macOS child-process permissions github.com
- Sophos: Developer job lure repository leads to malware execution on a Mac sophos.com
- Security Feature Bypass via Notebooks github.com
- Remote Code Execution via Workspace-injected Error Notification Link github.com
- Remote Code Execution via Skipped Workspace Trust github.com
- Workspace Trust Bypass via Terminal Relaunch and Reuse github.com
- Workspace Trust Bypass via Terminal Allowed Link Schemes Setting github.com
- The signature on a real installed copy, read by HARD with
codesign.