GitHub confirms breach of 3,800 repos via malicious VSCode extension • Hacker News Board

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#331

Post by 3form » Thu, May 21, 2026, 8:36 AM UTC

xyzzy123 wrote: post #246

Gigachad wrote: post #138

Earlier quoted context omitted.

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

Funnily enough a lot of this "extension sprawl" is caused by the _difficulty_ of installing tools on locked down Windows machines. I recently moved to a locked down SoE and instead of being able to use regular tools (which require a lengthy negotiation process to install) I now use extensions for absolutely everything, _because_ they're not currently policed in the same way...

I see the same thing. Similar for PyPI and NPM registry actually.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#332

Post by shideneyu » Thu, May 21, 2026, 8:37 AM UTC

dd8601fn wrote: post #180

overfeed wrote: post #162

Earlier quoted context omitted.

> Microsoft hasn't yet fucked it up the way they have so many other things. Not for lack of trying, the amount of CoPilot cruft bundled with the core IDE is growing quarterly.

Seriously. I think I saw they just added another “please use the agent chats here!” button. Every updates release notes is like 90% “now with more copilot plz use it.”

they pushed copilot too far.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#333

Post by Uptrenda » Thu, May 21, 2026, 8:38 AM UTC

What are the take aways from this? Should we avoid extensions now? Only install extensions from who you trust? What about if they get owned and you have auto-update extensions on as most people do?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#334

Post by philipallstar » Thu, May 21, 2026, 8:38 AM UTC

kristiandupont wrote: post #251

loloquwowndueo wrote: post #148

Earlier quoted context omitted.

Vs code is a weapon, designed to fracture. It being “good” is a weapon as well. https://ghuntley.com/fracture/

That seems like a very, very long-winded way of accusing them of "embrace, extend, extinguish"? Which is obviously not falsifiable, but just feels a bit trite at this point, IMO.

Things feeling trite isn't a counterargument, though.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#335

Post by shideneyu » Thu, May 21, 2026, 8:39 AM UTC

aa-jv wrote: post #312

hungryhobbit wrote: post #126

Earlier quoted context omitted.

I won't say "you can take my VS Code from cold dead hands" or anything, but it is a very good tool, and Microsoft hasn't yet fucked it up the way they have so many other things. I guess I'd say "you take my VS Code ... willingly ... but only after M$ fucks it up and makes me not want it anymore (like they've done to everything else they acquired)".

>Microsoft hasn't yet fucked it up I beg to differ. Have you inspected its network traffic?

can you develop ?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#336

Post by jakemm » Thu, May 21, 2026, 8:40 AM UTC

There is a Feature request from 2018 that I have been following for a long time to ask for VSCode Sadbox. I do not understand how Microsoft is not putting it up in priority.

https://github.com/microsoft/vscode/issues/52116

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#337

Post by 0xpgm » Thu, May 21, 2026, 8:40 AM UTC

panchtatvam wrote: post #317

notnullorvoid wrote: post #45

I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.

Sure. Microsoft will spin up a "SuPeR AI AgEnT" that will "fix" the issue. As an added benefit, it will officially promote Edge and Win 11 ( or K2 )

It is said that these agents make one 100x more productive by some accounts. Microsoft is big on AI agents.

If these claims were true, why don't they point the agents at the numerous stability and security issues they have across their various platforms?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#338

Post by baxtr » Thu, May 21, 2026, 8:43 AM UTC

hhh wrote: post #303

baxtr wrote: post #269

Earlier quoted context omitted.

I’m pretty sure there is an policy on their internal wiki saying you shouldn’t do that. Problem is: most employees don’t care to read these. Although I’m sure something like this could have been checked for during commit.

They can enforce it with an MDM. Policy should be enforced where possible not just notified to people.

Absolutely agree. But enforcing is so much more effort than creating wiki pages with LLMs.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#339

Post by KnuthIsGod » Thu, May 21, 2026, 8:47 AM UTC

Each day NeoVim / LazyVim sounds better to me...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#340

Post by zuhsetaqi » Thu, May 21, 2026, 8:48 AM UTC

camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

I'm also currently trying to switch from VS Code to Zed and my biggest hope was a better performing editor. The startup time is way better but the typing input is so laggy on my 2018 MacBook Pro 15". It's far worse than VS Code. Also the power usage of Zed is high.