Just a moment...
www.bleepingcomputer.com
  • FizzyOrange@programming.devEnglish
    2·
    4 hours ago

    There must be dozens of malicious extensions. I’m honestly surprised we haven’t seen it more. Chrome extensions get sold to shady people all the time; I would have thought VSCode extensions are even higher value targets.

    • Kelly@programming.devEnglish
      7·
      10 hours ago

      “We just had an outdated sanity.io dependency used since 2016 to show release notes from sanity headless CMS, that was the only issue they found.”

      “That dependency has been there since 2016 and passed every check since then, now it looks compromised but NO ONE from Microsoft reached us to remove it. They just pulled down everything causing issues to millions of users, and causing a loop in vscode (yep, it’s their fault)”

      If the dependency has been compromised then extensions that use that dependency and ship compromised code are also compromised. Its a transitive property if it ships bad code.

      With that in mind Microsoft yoinking the extension from the market place and user devices seems reasonable. But what was the “loop” they mention?

      • Kissaki@programming.devEnglish
        7·
        6 hours ago

        But what was the “loop” they mention?

        The linked issue comment has the info about it

        Letting you know that VSCode is unable to uninstall the extension. It prompts me to uninstall, but when I confirm the window refreshes and the extension is still there, triggering the same “is problematic” prompt. This is an infinite loop. Same behavior when trying to uninstall the usual way from the extensions panel.

    • Elgenzay@lemmy.mlEnglish
      31·
      9 hours ago

      Breaking: software with “free” in the name turns out to be malicious

  • Kissaki@programming.devEnglish
    1·
    6 hours ago

    lol, release-notes.js - obfuscated; at first I thought it was the release notes data or content, but maybe it’s the logic for displaying it?

    Outdated sanity-io dependency somehow led to compromise? I still don’t get how. It wouldn’t suddenly integrate something else. Does it source data from elsewhere during build, and that was compromised too? Does it call into the web for no reason in the first place?

    Either way, it’s an issue of their integration. Claiming “it’s not an issue in our extension” while shipping compromised code is just wrong.

    Obfuscating their index.js theme logic because it’s closed source may seem fine if they’re trustworthy, but with this violation and breach, that trust is gone.