And this is why you don't use VSCode.
Do you also not use SSH? Because that was also infected last year (XZ)
First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
11–20 of 63 posts
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#12Using non-printable characters to encode malicious code is creative, but I wouldn't say it "breaks our security model".
I would be pretty suspicious if I saw a large string of non-printable text wrapped in a decode() function during code review... Hard to find a legitimate use for encoding things like this.
Also another commenter[1] said there's an eval of the decoded string further down the file, and that's definitely not invisible.
Has no one thought to review the AI slop before publishing?
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#13"Here's the thing - this technique completely breaks traditional code review. You can't spot what you can't see. GitHub's diff view? Shows nothing suspicious. Your IDE's syntax highlighting? All clear. Manual code inspection? Everything looks normal.
The invisible code technique isn't just clever - it's a fundamental break in our security model. We've built entire systems around the assumption that humans can review code. GlassWorm just proved that assumption wrong."
This is pure Claude talk.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#14And this is why you don't use VSCode.
and this is why you must minimise and be extra careful with the extensions you install in your editor of choice.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#15Earlier quoted context omitted.
I'm surprised that Google hasn't deactivated the link in the 24+ hours since that article went online.
That should tell you (everyone) how much these companies actually care about our security the next time they claim to be stripping away our freedoms "for our security".
Google is a malware services company. They make money when someone creates malware OBS and pays Google for it to be the top result.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#16For anyone else curious WTH “invisible code” is… > invisible Unicode characters that make malicious code literally disappear from code editors.
Makes you wonder why unicode has invisible characters in the first place and why a compiler would interpret them at all.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#17I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server." "There's no hosting provider to contact, no registrar to pressure, no infrastructure to shut down. The Solana blockchain just... exists. " Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage. "Conn…
That blocks Solana only on your corporate network.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#18That's clever, but if your code review missed the perfectly visible line
eval(atob(decodedString))
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#19What are the specific "Unicode variation selectors" in question?
I'd like to implement some simple linting against them.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#20"Here's the thing - this technique completely breaks traditional code review. You can't spot what you can't see. GitHub's diff view? Shows nothing suspicious. Your IDE's syntax highlighting? All clear. Manual code inspection? Everything looks normal. The invisible code technique isn't just clever - it's a fundamental break in our security model. We've built entire systems around the assumption that humans can review…
it sure is and it's complete bullshit too!
that screenshot looks suspicious as hell, and my editor (Emacs) has a whitespace mode that shows unprintable characters sooooo
if GitHub's diff view displays unprintable characters like this that seems like a problem with GitHub lol
"it isn't just X it's Y" fuck me, man. get this slop off the front page. if there's something useful in it, someone can write a blog post about it. by hand.