41–50 of 63 posts
I have started denying any kind of non-ASCII characters in the source code. I understand this is extremely limiting, but it does do the trick. For now.
I have started denying any kind of non-ASCII characters in the source code. I understand this is extremely limiting, but it does do the trick. For now.
I mean, someone could still run a string of printable characters into "decode" and then "eval"...
For anyone else curious WTH “invisible code” is… > invisible Unicode characters that make malicious code literally disappear from code editors.
So, they have a custom decode function that extracts info from unprinted characters which they then pass to `eval`. This article is trying to make this seem way fancier than it is. Maybe GitHub or `git diff` don't give a sense of how many bits of info are in the unicode string, but the far scarier bit of code is the `eval(atob(decodedString))` at the bottom. If your security practices don't flag that, either at code…
Using non-printable characters to encode malicious code is creative, but I wouldn't say it "breaks our security model". I would be pretty suspicious if I saw a large string of non-printable text wrapped in a decode() function during code review... Hard to find a legitimate use for encoding things like this. Also another commenter[1] said there's an eval of the decoded string further down the file, and that's definite…
> Has no one thought to review the AI slop before publishing?
If only Koi reviewed their AI slop before publishing :(
I have started denying any kind of non-ASCII characters in the source code. I understand this is extremely limiting, but it does do the trick. For now.
If all you're interested in is which extensions have been infected: Compromised OpenVSX Extensions: codejoy.codejoy-vscode-extension@1.8.3 codejoy.codejoy-vscode-extension@1.8.4 l-igh-t.vscode-theme-seti-folder@1.2.3 kleinesfilmroellchen.serenity-dsl-syntaxhighlight@0.3.2 JScearcy.rust-doc-viewer@4.2.1 SIRILMP.dark-theme-sm@3.11.4 CodeInKlingon.git-worktree-menu@1.0.9 CodeInKlingon.git-worktree-menu@1.0.91 ginfuru.be…
I have started denying any kind of non-ASCII characters in the source code. I understand this is extremely limiting, but it does do the trick. For now.
This is an old-man rant, but the first time I saw Unicode I felt like I was looking at a train wreck coming from a long way off. It has too many edge cases, footguns and unintuitive artifacts like this. I wish we constrained its use to only where required. Text was so much easier to reason about and safer to manipulate in the ASCII days.
It's about safety.
If all you're interested in is which extensions have been infected: Compromised OpenVSX Extensions: codejoy.codejoy-vscode-extension@1.8.3 codejoy.codejoy-vscode-extension@1.8.4 l-igh-t.vscode-theme-seti-folder@1.2.3 kleinesfilmroellchen.serenity-dsl-syntaxhighlight@0.3.2 JScearcy.rust-doc-viewer@4.2.1 SIRILMP.dark-theme-sm@3.11.4 CodeInKlingon.git-worktree-menu@1.0.9 CodeInKlingon.git-worktree-menu@1.0.91 ginfuru.be…
I was freaking out for a bit.
If all you're interested in is which extensions have been infected: Compromised OpenVSX Extensions: codejoy.codejoy-vscode-extension@1.8.3 codejoy.codejoy-vscode-extension@1.8.4 l-igh-t.vscode-theme-seti-folder@1.2.3 kleinesfilmroellchen.serenity-dsl-syntaxhighlight@0.3.2 JScearcy.rust-doc-viewer@4.2.1 SIRILMP.dark-theme-sm@3.11.4 CodeInKlingon.git-worktree-menu@1.0.9 CodeInKlingon.git-worktree-menu@1.0.91 ginfuru.be…
cline is used by a lot of devs
"Here's the thing - this technique completely breaks traditional code review. You can't spot what you can't see. GitHub's diff view? Shows nothing suspicious. Your IDE's syntax highlighting? All clear. Manual code inspection? Everything looks normal. The invisible code technique isn't just clever - it's a fundamental break in our security model. We've built entire systems around the assumption that humans can review…
it sure is and it's complete bullshit too! that screenshot looks suspicious as hell, and my editor (Emacs) has a whitespace mode that shows unprintable characters sooooo if GitHub's diff view displays unprintable characters like this that seems like a problem with GitHub lol "it isn't just X it's Y" fuck me, man. get this slop off the front page. if there's something useful in it, someone can write a blog post about…