I'm more surprised hackers found a large enough uptime window to do this.
Copying a joke posted somewhere else? Wow https://x.com/anshuc/status/2056898035159056558
GitHub confirms breach of 3,800 repos via malicious VSCode extension
221–230 of 488 posts
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#222Why is the extension not being named?
Because the link is blogspam.
https://github.blog/security/investigating-unauthorized-acce... links to https://github.com/nrwl/nx-console/security/advisories/GHSA-... Nx Console
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#223Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#224Zed extensions are sandboxeds with restricted permissions btw…
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#225Earlier quoted context omitted.
The 3800 repos weren't exfiltrated from the compromised machine. The malware (be it a VSCode plugin, an npm package, or whatever is next) simply slurps up all of the users private keys/tokens/env-vars it can find and sends this off somewhere covertly. It's trivial to do this in a way to avoid detection. The small payload can be encrypted (so it can't be pattern matched) and then the destination can be one of millions…
> It's trivial to do this in a way to avoid detection I'd love to see a real example/PoC. Anyway, we discussed this issue in the other thread. For me, unrestricted outbound requests to any url, whether it's well known domains like api.github.com or any other domain, are a red flag. Why does VS need to establish outbound requests to any domain, without authorization? There's no magic solution, and these attacks will e…
We need to stop normalizing outbound connectivity by default. In fact we should be alerted anytime something tries to go outbound.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#226friendly reminder: - disable auto-updates for extensions in VS Code/Cursor - use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security - for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e..…
Or how about just don't allow your VS extensions outbound Internet access ...
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#227Someone scold me if I'm wrong but this is really worrying. Threat actors with Github's internal code means a huge acceleration in vulnerability discovery for the one platform where everybody warehouses their code.
How is this not really, really bad?
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#228If they tighten up things, it would impact the ease of use.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#229Earlier quoted context omitted.
> Migrate off vscode already. Zed is the closest thing I've found to meet my needs, and I do plan to try it. However it's dev container support looks to be lacking in some important ways so we'll see.
Zed is even worse about arbitrarily downloading random stuff from random websites and executing it
How so?
Part of what seemed good about Zed was that extensions have explicit permission controls.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#230Someone scold me if I'm wrong but this is really worrying. Threat actors with Github's internal code means a huge acceleration in vulnerability discovery for the one platform where everybody warehouses their code. How is this not really, really bad?
[dead]