Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

201–210 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#201

Post by jamesfinlayson »

tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

I remember working at a company with at least 5,000 repos across five or six GitHub orgs, plus more stuff in Perforce.

Probably some old experiments in there but the company had its fingers in a few pies and some departments didn't mind creating yet another service to solve a problem.

I definitely archived the old stuff in my department (we had eight repos and that felt like enough for three people).

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#202

Post by stingraycharles »

dlcarrier wrote: post #177
lacker wrote: post #116

Earlier quoted context omitted.

Perfectly demonstrating the truth of the "Microsoft org chart" cartoon. https://bonkersworld.net/organizational-charts

At first I though the Apple one had a half-dozen departments actually coordinating on something, but then I took a closer look and realized it's just more micromanagement.

I think the chart is still from the Steve Jobs era, who definitely was known to be a micromanager.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#203

Post by zx8080 »

> "Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately,"

So great that they removed the extension! Do they do it only after their own employee was infected? And why "unnamed" extension?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#204

Post by getpokedagain »

LiamPowell wrote: post #178
getpokedagain wrote: post #152

Earlier quoted context omitted.

Not trolling here but these things are by design cesspools ready for compromise. Any fully open ecosystem where contributions are not strictly reviewed is open to this problem. If you don't like it, don't use editor extensions and use a well audited editor. If you want to use extensions or node packages or pypi packages without doing a detailed review you're accumulating technical debt. You're assuming a risk in orde…

Extensions never had to be given unsandboxed access to everything. That's a choice that they actively made.

I mean I don't think some sort of "access control" within the editor is going to really address this. People edit sensitive text in their code editor and no matter what that is going to be available to most useful extensions. Even if you don't lose a credential or get some arbitrary script running to mine crypto on your machine you could have an extension function as a key logger and exfil code you really think is valuable.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#205

Post by vldszn »

bmandale wrote: post #196
vldszn wrote: post #190

Earlier quoted context omitted.

UPD: it’s confirmed now by the CEO of Nx https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_...

> One of our developers was compromised by a recent supply-chain compromise on Tanstack ...which in turn was caused by bad design of github's CI pipeline. Funny how it all comes back around like that.

Yeah..full circle

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#206

Post by matkoniecz »

BowBun wrote: post #153
lacker wrote: post #116

Earlier quoted context omitted.

Perfectly demonstrating the truth of the "Microsoft org chart" cartoon. https://bonkersworld.net/organizational-charts

I've seen this a million times, but aren't the Amazon and Apple ones kinda the same, just differently shaped?

Also, Apple has master micromanager overriding managers.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#209

Post by nstart »

atq2119 wrote: post #191
miki123211 wrote: post #173

Earlier quoted context omitted.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

Fully agree with the first half of your comment. The second half goes off the rails, though. I rarely see people complain about sandboxing. What people complain about is when devices are locked down in a way where you are only allowed to install software that is approved by a central gatekeeper, even though sandboxing is in place that should make it far safer to run arbitrary safer than on traditional desktop systems…

Agreed. What's frustrating is that we have models for how sandboxing can work and instead of investing efforts into nailing that experience, the OS providers are prone to turning it into a monetization/lock in layer instead. My VLC and VS Code should have an OS native way of being limited to particular functionality. But when the OS providers implement the sandbox, they center it around an App Store and restrictions on only apps that have been notarized where said notorization costs money or a requires a subscription. And then they remove the ability to do things which their own native apps can do and set tighter controlling rules on what APIs apps can ever have access to.

When all I wanted was for VLC or similar to run in a sandbox by default where a plug-in I install can't do anything to my system or access the internet by default because the software itself is restricted to just the files I'm using and that's it.

Post reply on HN