Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instance…
The issue to which op links now yields 404. What's up with that?
Material Theme has been pulled from VS Code's marketplace
111–120 of 424 posts
Re: Material Theme has been pulled from VS Code's marketplace
#112@dang can you please update the link to the archive link
Re: Material Theme has been pulled from VS Code's marketplace
#113100s of people disrupted because Microsoft remotely changed the colours in their editor? Come on, people, you need to own your own tools.
Re: Material Theme has been pulled from VS Code's marketplace
#114Earlier quoted context omitted.
Was Material even his work in the first place?
Looks like it was, or at least the initial commit was. This was back in 2017. https://github.com/material-theme/vsc-material-theme/commits... I'm not sure why the initial commit already says "official", but that's almost a decade ago.
The initial commit was in 2015 and was MIT licensed for a couple of years before it was changed to Apache licensed. It's unclear if any of the other contributors gave permission for this change to happen.
https://github.com/material-theme/vsc-material-theme/commit/...
Re: Material Theme has been pulled from VS Code's marketplace
#115Earlier quoted context omitted.
It does, you just needs to find the last one before force push and click “browse repository at this point” and it will slow the pre force push history
Feel free to check for yourself, but the commits where the repo is licensed as MIT are not reachable from that UI - only the commits where the repo is licensed as Apache 2.0 (and the later self- created license). The earliest available activity entry is from 2023, which bottoms out at an initial commit from 2017. The code base is actually older than that having been started in 2015. The commits which have the real un…
https://github.com/material-theme/vsc-material-theme/commit/... is the initial MIT licensed commit
Re: Material Theme has been pulled from VS Code's marketplace
#116Earlier quoted context omitted.
This is tracked in this feature request https://github.com/microsoft/vscode/issues/52116 We do not plan to add a permission model in the next 6 months.
Given the enormity of the attack surface that has just been exposed, that's disappointing.
This isn’t really exposed so much as exploited. This was always possible.
Re: Material Theme has been pulled from VS Code's marketplace
#117I'm quite happy that nowadays most tools have competently made themes out of the box, so that if someone wants to minimize risks from something like this and keep the extensions/addons they install to a minimum, that's pretty viable. Of course, it's also nice that it's possible to theme the software to such a degree and improve usability and accessibility in some cases, just that the feature requests about limiting p…
I find it curious that themes can be a security risk at all. Clearly, they consist of more than just the colour codes and don't definitions one might assume. Maybe the theming system needs to be tightened.
Re: Material Theme has been pulled from VS Code's marketplace
#118Earlier quoted context omitted.
Given the enormity of the attack surface that has just been exposed, that's disappointing.
This isn’t really exposed so much as exploited. This was always possible.
you're right. it's not new. https://www.bleepingcomputer.com/news/security/malicious-vsc...
Re: Material Theme has been pulled from VS Code's marketplace
#119Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
[flagged]
Re: Material Theme has been pulled from VS Code's marketplace
#120Hey y'all, I made the most prominent fork of this extension "Material Theme (But I Won't Sue You)" The maintainer went off the deep end last year. He pulled the (originally apache 2) source offline, then started threatening to sue people for hosting alternative versions, including them in other IDEs, etc. Genuine lunatic. Out of an abundance of precaution, I've taken the following action on my fork: 1. I have the VS…
[flagged]
He's being as helpful as possible, there's no need to go hard on his language like this.