21–28 of 28 posts
I've heard about these attacks but never really had the time to understood what was happening. Some of our junior devs use VS Code, so now we have something to point them at.
I smelled something fishy and never ran it though.
Earlier quoted context omitted.
VS Code will helpfully warn you when you open a folder that has a git repository.. it asks if you trust the developers since opening the folder could result in bad things happening. So this might not be such a big deal for VS Code users.
You know they're just gonna click yes, right? That prompt is just there so they can say "your fault!"
As I understand one don't need to have AI agents or something similar to be pwned. It's enough to clone a repository using git, since it allows executing arbitrary hooks for post-checkout.
There are software/devs that make sane security choices, and then there's the ones that don't (usually the younger/more modern ones)