Earlier quoted context omitted.
The 3800 repos weren't exfiltrated from the compromised machine. The malware (be it a VSCode plugin, an npm package, or whatever is next) simply slurps up all of the users private keys/tokens/env-vars it can find and sends this off somewhere covertly. It's trivial to do this in a way to avoid detection. The small payload can be encrypted (so it can't be pattern matched) and then the destination can be one of millions…
> It's trivial to do this in a way to avoid detection I'd love to see a real example/PoC. Anyway, we discussed this issue in the other thread. For me, unrestricted outbound requests to any url, whether it's well known domains like api.github.com or any other domain, are a red flag. Why does VS need to establish outbound requests to any domain, without authorization? There's no magic solution, and these attacks will e…
I don't know but it's very standard practice in most applications, because telemetry. But VS code is one of the worst: just check open snitch when running VS code, it's constantly phoning to a bunch of IPs.