GitHub confirms breach of 3,800 repos via malicious VSCode extension • Hacker News Board

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#341

Post by Gigachad » Thu, May 21, 2026, 8:51 AM UTC

salawat wrote: post #220

miki123211 wrote: post #173

Earlier quoted context omitted.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

Never let a crisis go to waste, huh? We've had the solution to shit like this, and it's called the SecurityManager in Java. No one wants to configure the damn thing, but it is there. Also, auditing the code you pull in . Yeah. Reading code sucks. Yeah. It's a lotta work. But if you don't check, you don't effing know. All y'all want the fun of unprotected sex (rawdogging the ecosystem) and are starting to get burned b…

This is about as useful as telling people to read the full terms of services of everything they use. That might be easier than auditing every line of code you run.

I’ll tell my employer to put the feature on hold for 20 years while I read the source of every package.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#342

Post by jack-pissy » Thu, May 21, 2026, 8:52 AM UTC

some of the repos that were listed by these hackers(summarized by LLM):

Funny / Odd Names

old-man-yells-at extremely-verbose-application mildly-sentient-scripts awful-git-machine awful-archive-machine slop-trap yaktriage yakety-yak what-in-the-shell gh-hell amen afk beer coffee

Octo-Themed

octoqueer octogatos octokeg octopets-prototype octoquarium octodex force-directed-octocat

Animal / Random Names

kittens Cats-of-GitHub accesscats-and-friends adacats-and-friends suave-capybaras nifty-armadillos cuddly-broccoli torched-marshmallows

AI / Experimental

reflect-gpt reflect-gpt-reloaded experimental-copilot-server agentic-memory-playground codeml-autofix copilot-mission-control llm-assist snippet-gpt meeting-summarizer

Internal Culture / Tools

no-meeting-friday-reminder engineering-deadlines engineering-operations-playground forced-deploys four-nines-alerts incident-responder oncall-issue-creator alert-routing-verifier dependency-audit availability-risk-register

Misc / Interesting

the-after-party pong gameoff github-games caption-this haikus-for-codespaces this-day-in-github-history

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#343

Post by Gigachad » Thu, May 21, 2026, 8:53 AM UTC

moring wrote: post #285

Gigachad wrote: post #273

Earlier quoted context omitted.

These kinds of permissions lists have been mostly a failure in history. Users see a massive list of permissions, or permissions constantly changing between updates and just ignore them because there’s no way to reasonably audit them or take any action on them. Securing VS code would require making malware that has access to the system impossible, not just making it add a permission to the permission list.

Ideally, the permission list is meant for curators which end-users trust and can rely on. Also, historically, permission lists have been fine-grained but too coarse at the same time, meaning they were "fine" in the wrong way, based on what is easy to implement instead of what the user needs.

Most of the recent compromises have been from trusted people who had their accounts compromised. So just picking someone you trust doesn’t work out.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#344

Post by enbugger » Thu, May 21, 2026, 8:54 AM UTC

KnuthIsGod wrote: post #339

Each day NeoVim / LazyVim sounds better to me...

It shouldn’t. Same 3rd party extensions distribution model like in VSCode just written in Lua instead

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#345

Post by dust-jacket » Thu, May 21, 2026, 8:59 AM UTC

seanieb wrote: post #316

21asdffdsa12 wrote: post #307

Earlier quoted context omitted.

Because centralized management of resources is the death of innovation, intrinsic motivation and speed? The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task. The security tax and speeding tickets on everything are a luxury destroying much value.

Your company getting hacked because of random plugins for emerging or dysfunctional ecosystems that don’t have enterprise management solutions yet is worth it to avoid friction?

Yes and no.

The friction they should have probably had here is: did this employee need access to 3,800 internal repos?

I'm with the poster above in believing restricting what you can install makes a lot of things more difficult, but if you're going to take the risk you should be limiting the blast radius.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#346

Post by miroljub » Thu, May 21, 2026, 9:02 AM UTC

camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

I think we reached the point where it's not reasonable to expect that Microsoft is capable of improving anything. Their products all go in the same direction.

The best case for Microsoft software I hope for is that they do only some minor UI cosmetic changes, but even that often goes catastrophically wrong.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#347

Post by 9dev » Thu, May 21, 2026, 9:02 AM UTC

furyman wrote: post #326

I was using Intellij until start of last year and then my organisation started pushing towards vibe coding. To my wonder, the models selection option is not available in Intellij but available only VSCode. The whole UI is mess and so scattered. It's a nightmare if you're coming from intellij. Plus on the verge of security violation on behalf of any extension you would just want to try on.

I’d recommend just using a CLI harness in IntelliJ. The user experience is eons ahead, and you don’t miss out on anything other than flashy UI.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#348

Post by ulimn » Thu, May 21, 2026, 9:08 AM UTC

I'm surprised that we have a lot of comments but still no alternative which would be secure by design. Meaning, not downloading stuff shadily in the background like Zed, or allowing extensions to roam free like VSCode...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#349

Post by shandilyaharsh » Thu, May 21, 2026, 9:12 AM UTC

shouldn't anthropic give mythos access to github, prolly the most insecure piece of software while also being the most important one

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#350

Post by dgellow » Thu, May 21, 2026, 9:14 AM UTC

ulimn wrote: post #348

I'm surprised that we have a lot of comments but still no alternative which would be secure by design. Meaning, not downloading stuff shadily in the background like Zed, or allowing extensions to roam free like VSCode...

I might just go back to emacs :(