Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

191–200 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#191

Earlier quoted context omitted.

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

Fully agree with the first half of your comment. The second half goes off the rails, though.

I rarely see people complain about sandboxing.

What people complain about is when devices are locked down in a way where you are only allowed to install software that is approved by a central gatekeeper, even though sandboxing is in place that should make it far safer to run arbitrary safer than on traditional desktop systems.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#192

Earlier quoted context omitted.

I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.

What are you withholding from the sandbox without making it useless?

Internet access. An editor extension does not need it.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#193

Earlier quoted context omitted.

Extensions never had to be given unsandboxed access to everything. That's a choice that they actively made.

its easy to complain, words are cheap. fork it and change it if you don't like it

It's easy to wave a magic wand and have one developer do better than a corporation of tens of thousands. There is a reason I don't use Microsoft products: I can't do it myself and do won't do it for me.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#194

If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.

Well, it certainly wasn't for lack of warning about the glaring risks...

https://github.com/microsoft/vscode/issues/52116

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#195

Earlier quoted context omitted.

For those not getting the joke, GitHub has had an increasingly difficult keeping itself up since Microsoft acquired them. It's gotten a lot worse (and made news) more recently, as the downtime as increased.

*since coding agents caused their commit rate to increase 14x.

A problem that they contributed to.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#196
post #190
post #17

Earlier quoted context omitted.

There are rumours that was NX Console VS code extension https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...

UPD: it’s confirmed now by the CEO of Nx https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_...

> One of our developers was compromised by a recent supply-chain compromise on Tanstack

...which in turn was caused by bad design of github's CI pipeline. Funny how it all comes back around like that.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#197
post #102

Earlier quoted context omitted.

I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo... I wonder if it was open-vsx specific?

That’s very possible. I switch between Cursor and VS Code, don’t remember which it was that day.

I think I checked a few weeks ago and whatwedo.twig was not on OpenVSX at that time, so I'm suspecting it is a case of name-squatting.

This seems to be confirmed here: https://socket.dev/openvsx/package/whatwedo.twig/versions/1....

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#198

Earlier quoted context omitted.

Extensions never had to be given unsandboxed access to everything. That's a choice that they actively made.

its easy to complain, words are cheap. fork it and change it if you don't like it

Then you lose access to the VSCode marketplace which kind of defeats the purpose.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#199
post #111
post #44

The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…

I am so, so stressed about Sublime Text... It feels like a massive disaster just waiting to happen. They don't even run their own package marketplace :(

There are so few users of sublime text that it likely isn’t a juicy enough target for these sorts of exploits.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#200

Earlier quoted context omitted.

What are you withholding from the sandbox without making it useless?

Internet access. An editor extension does not need it.

All AI agent extensions disagree in unison.
Post reply on HN