Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

321–330 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#321

Post by 21asdffdsa12 »

overfeed wrote: post #162
hungryhobbit wrote: post #126

Earlier quoted context omitted.

I won't say "you can take my VS Code from cold dead hands" or anything, but it is a very good tool, and Microsoft hasn't yet fucked it up the way they have so many other things. I guess I'd say "you take my VS Code ... willingly ... but only after M$ fucks it up and makes me not want it anymore (like they've done to everything else they acquired)".

> Microsoft hasn't yet fucked it up the way they have so many other things. Not for lack of trying, the amount of CoPilot cruft bundled with the core IDE is growing quarterly.

Makes me wish, we could just have some "Metric" sin-goat, that is basically some nonsense fork of the project, that the process can ruin for "promotion" crystals or whatever, while the actual project runs unaffected on in the background.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#322

Post by dannersy »

21asdffdsa12 wrote: post #307
danpalmer wrote: post #256

Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.

Because centralized management of resources is the death of innovation, intrinsic motivation and speed? The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task. The security tax and speeding tickets on everything are a luxury destroying much value.

This is the new old way. This was fine before irresponsible use of AI. Between vibe coding and using AI to find vulnerabilities as a result of vibes, I'm afraid that we will have to find ways to have more controlled environments.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#323

Post by tliltocatl »

Gigachad wrote: post #276
skydhash wrote: post #261

Earlier quoted context omitted.

No one using vim will install the kind of extensions I found on the usual VS Code setup. And most don't even autoupdates.

I’m not sure this is true. Vim needs extensions even more than VS code since many basic features like full project code search or go to definition aren’t in the base vim. And vim has package managers that make installing and updating packages as easy as vs code. VS Code like npm are only the targets because they are the most popular, not because they are uniquely vulnerable.

> full project code search

grep

> go to definition

/definition

Not even using vim, I'm more of a micro person.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#324

Post by 21asdffdsa12 »

dd8601fn wrote: post #180
overfeed wrote: post #162

Earlier quoted context omitted.

> Microsoft hasn't yet fucked it up the way they have so many other things. Not for lack of trying, the amount of CoPilot cruft bundled with the core IDE is growing quarterly.

Seriously. I think I saw they just added another “please use the agent chats here!” button. Every updates release notes is like 90% “now with more copilot plz use it.”

Sir Copealot a noble knight whose services remained unwanted.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#325

Post by sunshine-o »

tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

Because everything in Github is designed for growth: Easy to create a repo, very hard to delete it (a lot of scrolling, clicking, copy/pasting the full name of the repo, etc.) I mean "Deleting", not "Archiving".

MS and Github need their number to go up, not having people cleaning up their repos to avoid any loose ends.

I have hundreds of them, it took me a few hour to delete the unused ones. In a medium size org with thousands of them, it will take weeks for security to do a cleanup.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#326

Post by furyman »

I was using Intellij until start of last year and then my organisation started pushing towards vibe coding. To my wonder, the models selection option is not available in Intellij but available only VSCode. The whole UI is mess and so scattered. It's a nightmare if you're coming from intellij. Plus on the verge of security violation on behalf of any extension you would just want to try on.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#327

Post by raxxorraxor »

zkmon wrote: post #298

I ditched VSCode for Sublime Text long back and don't feel missing anything. If any, my productivity and control over things has only improved.

I ditched Github for Gitea. If I want to share the code I can use completely distinct credentials and I don't "login" into my IDE. Although the latter doesn't help, an IDE can extract any form of secret just fine, but you can still minimise the risk.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#328

Post by tmtvl »

stephenr wrote: post #318
aa-jv wrote: post #314

Earlier quoted context omitted.

How about just don't become dependent on an IDE and don't use technologies which require that dependency...

Good point. Any editor is a needless dependency. True developers just scream at the universe and it responds with cosmic radiation that flips the correct bits to form the binary code they intended.

Ah, good old 'M-x scream-into-void'. My most-used Emacs feature after 'M-x butterfly'.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#329

Post by alexfoo »

schpet wrote: post #133
alexfoo wrote: post #85

Earlier quoted context omitted.

The problem is that the main target for these repos are the internal IaaS type repos that contain much of the juicy information. A fine grained token is likely to have read access to the IaaS repo as that is likely the very repo they are operating on when the malware compromises them. 3800 repos up for blackmail may make a good headline but it's likely that Github don't really care about 3798 of those repos being mad…

i was more thinking like, if i am working on project ABC for org XYZ it's understandable that if my dev vm gets owned that ABC is leaked. it's not that acceptable if all of org XYZ's repos that i have access to get leaked. and especially not acceptable if everything i have access to, including other orgs, and the admin ability to do destructive operations on them, gets exposed. but status quo is that that's absolutel…

I completely agree, but I don't think many developers will enjoy the new hoops that will need to be jumped through in order to do various things more securely.

Having to switch between accounts with different tokens with vastly pared down access is going to feel quite restrictive and suffocating.

Some devs won't have the patience to wait for some other department to vet and import a new npm package, or the latest update to it, before it can be used.

Some devs will be frustrated not being able to run their favourite IDE which isn't on the approved list, or their favourite plugins which haven't been vetted yet.

Some devs will get annoyed that they have to reboot more and more frequently to get the latest OS updates because things like Copy-Fail/CVE-2026-31431 appear out of nowhere and can be weaponised by malware to break between accounts or out of VMs and other sandboxed envs to get access to more keys/PATs/etc.

Another alternative is endless MFA requests which leads to request fatigue and accidentally approving the malicious/unwanted action.

It's going to be interesting how the industry deals with all of this. I can see it getting a lot worse with some even more significant breaches before it starts to get better.

Post reply on HN