The Kickbacks.ai VS Code extension acts as adware by modifying the Claude Code extension's files to inject ads and relax its Content Security Policy, and it maintains persistence by re-applying these changes every 60 seconds. The primary threat is its unsigned, automatic self-update mechanism, which runs every 90 seconds without signature verification, allowing a potential compromise of its update server to deliver malicious code to all installed clients. The extension has been removed from the VS Code Marketplace, and the immediate workaround is to uninstall it from any developer machines.
← Back to blog supply chain adware developer tools VS Code AI security reverse engineering Claude Code Kickbacks.ai Security Review: VS Code Adware With a Payout Page Kickbacks.ai security review and reverse engineering. This VS Code extension patches files, runs unsigned updates, and acts as adware. What businesses should know. Darius J Davis · June 23, 2026 TL;DR: Kickbacks.ai is a VS Code extension that patches Claude Code 's files, weakens its security policy, and auto-updates every 90 seconds with no signature verification. The domain is 5 weeks old. It was removed from the VS Code Marketplace. Security issues on GitHub have zero maintainer response. Three competitors offer 70% revenue share without touching your files. If your developers installed this, remove it. # Developer tools that pay you to use them should raise questions. A VS Code extension called Kickbacks.ai has been making the rounds on developer social media. The pitch: install it, let it show ads in Claude Code's loading spinner, collect a 50/50 revenue split. Popular tech accounts have been endorsing it. Screenshots of earnings dashboards are everywhere. We installed it, ran it for three days, then reverse-engineered the entire bundled source code and captured the network traffic with Wireshark . What we found is not a developer tool. It's adware with a Stripe payout page. ~/security/kickbacks-audit · reverse engineering # What it does to the machines it runs on. Kickbacks doesn't just display ads. It patches the files of another extension on disk . Specifically, it modifies Anthropic's Claude Code extension by appending JavaScript to the webview and relaxing the Content Security Policy to open a localhost communication channel. Every 60 seconds, it checks whether those patches are still in place. If anything removed them, it re-applies them automatically. If the ad overlay stops responding for 5 minutes, it escalates through patch cycling, forced webview reloads, and user-facing notifications. This is persistence behavior. It's the kind of thing endpoint detection tools flag. Here's what it looks like when you're watching it happen: ~/security/kickbacks-audit · monitoring persistence + self-update # The self-update pipeline is unsigned. That's the real danger. Every 90 seconds, the extension polls a remote server for a new version. If one exists, it downloads and installs it automatically. The code contains a signature verification function, but the embedded public key is an empty string. The verification never runs. The SHA-256 hash and the download both come from the same server. If that server is ever compromised, every machine running this extension installs whatever the attacker pushes. Silently. Every 90 seconds. There is no setting to disable this. Think about what that means. If someone compromises a single Google Cloud Storage bucket, they can push code to every developer machine running Kickbacks. That code runs inside VS Code with full access to your filesystem, your terminal, your SSH keys, your environment variables, your source code. The extension already has the permissions. The CSP is already relaxed. The auto-update pipeline is already trusted. An attacker wouldn't need to break anything new. They would just use the door Kickbacks already opened. This is the supply chain attack pattern. Trust a vendor. Vendor gets compromised. Every customer inherits the compromise automatically. # The legal protection is a joke. Their Terms of Service cap their liability at $100 . That's Section 15.2 . If their unsigned update pipeline gets compromised and your source code gets exfiltrated, the most they owe you is a hundred dollars. Meanwhile, Section 11.2 says you bear sole responsibility for making sure this doesn't violate Anthropic's terms. Section 16.1 says you indemnify Kickbacks against any claims from your employer or platform providers. And Section 4e of their license says you cannot disable their telemetry or security mechanisms. So protecting yourself from the unsigned update pipeline violates their terms. They take 50% of the revenue. You take 100% of the risk. And the maximum they'll ever pay for the damage is less than your monthly coffee budget. # The red flags keep stacking. The domain was registered 5 weeks ago , hidden behind a WHOIS privacy proxy. There is no publicly available contact, help, about, or support page on their site. The extension was removed from the VS Code Marketplace . Install is only possible via a direct file download that bypasses all marketplace review. There are open security vulnerabilities on GitHub with zero maintainer response . Issue #86 demonstrates how anyone can fabricate unlimited billable impressions, directly charging advertisers for views that never happened. Issue #107 documents six more vulnerabilities including a hardcoded click token and leaked admin API docs. The founder's GitHub bio describes the project as "AI hobbies." The homepage claims $89,401 earned by developers on a p...