I'm always a little cautious about plugins I install for text editors or browsers, but can they be dangerous and cause the text editor or browser to behave in a malicious way?

For example, can a plugin for Atom or Firefox read files and delete them? Or access and send them to an unknown attacker?

How can one avoid installing such plugins?

  • it depends on the capabilities the host app provides the plugin, sometimes restricted by plugin type. Without delving into specifics, you should assume the worst; that the plugin can use whatever the app's core language features provide, especially on general-purpose things like an editor plugin (as opposed to say, a audio filter or visualizer).
    – dandavis
    Apr 23, 2019 at 18:37

2 Answers 2


Yes they can.

Only install plugins you have verified as trustworthy, both in authorship and distribution.


Plugins affect the way that the software behaves. So, it would be possible to write a plugin to do something malicious. And it's not just IDEs or text editors, but browsers or any software that allows plugins could be affected.

You also have to define what you mean by "malicious"? Can a plugin act as a remote access trojan? Probably not, but that depends on what the core software can do and what capabilities are exposed by the core software. Can a plugin modify or delete files maliciously? Of course.

You must log in to answer this question.