Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

401–410 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#401

Post by ofjcihen »

wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

Did work for a company last week that get popped pretty badly during a round of Shai even though they were aware of the packages.

Turns out no amount of communication to the team matters when you set Copilot to autopilot and it’s not aware of the compromised packages.

I suspect that’s going to be a trend.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#402

Post by notnullorvoid »

IshKebab wrote: post #391
camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

> I hope Zed continues to improve their extension and language server security model. To be honest I doubt there's much that they can do. Many many language servers cannot run in WASM, or it would be super hard to compile them to WASM. So Zed either has to allow running arbitrary binaries like VSCode, or accept that they're going to have really poor extension support.

Running binaries I already have installed in a containerized environment is fine, automatically installing them on host machine and/or container is not.

I should be able to limit what binaries extensions have access to though.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#403

Post by gjtorikian »

fragmede wrote: post #223
gjtorikian wrote: post #221

Earlier quoted context omitted.

Copying a joke posted somewhere else? Wow https://x.com/anshuc/status/2056898035159056558

Thinking a GitHub uptime joke is so creative only one person could have thought of it? Wow.

It’s a word for word copy from the original.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#404

Post by luodaint »

Your extensions in VSCode have ambient access to your filesystem, your tokens, and your environment. The servers of tools like Claude Code or Cursor have that ambient access too. This was justified for Nx Console's purposes. This is justified in a coding agent's filesystem MCP. The exact same trust model: install it, it runs, you trust its scope implicitly.

What I ended up changing after contemplating this matter: all my MCP servers are scripts from my repository and not npm packages. All the information about the scopes these servers can use is contained explicitly in my context file (certain directories, certain tools). There's nothing untrusted reaching my filesystem/tokens.

There's the same supply chain problem in VSCode extensions as there is with the MCP servers. Very few companies that audit their extensions started auditing their MCP servers.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#405

Post by lawn »

ulimn wrote: post #348

I'm surprised that we have a lot of comments but still no alternative which would be secure by design. Meaning, not downloading stuff shadily in the background like Zed, or allowing extensions to roam free like VSCode...

Both Emacs and Neovim gives you full control IF yhats what you're after.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#406

Post by galangalalgol »

coldtea wrote: post #383
zuhsetaqi wrote: post #340

Earlier quoted context omitted.

I'm also currently trying to switch from VS Code to Zed and my biggest hope was a better performing editor. The startup time is way better but the typing input is so laggy on my 2018 MacBook Pro 15". It's far worse than VS Code. Also the power usage of Zed is high.

If it uses npm plugins, it's the same crap you get with vscode, just with a rust facade.

Is helix too minimalist? No js, just rust and tree sitter queries. Full lsp integration and everything just works.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#407

Post by crabbone »

mschuster91 wrote: post #368
crabbone wrote: post #357

Earlier quoted context omitted.

Before I say anything: I don't use VSCode and have no intention of doing so. Most of my experience is gained vicariously, through working with or helping someone else who does. I use Emacs for my day-to-day stuff. I don't think Emacs extensions are more secure by design. Pretty sure that, if I wanted to, I could craft an extension that does bad things. I'm not sure how hard it would've been to sneak it past MELPA or…

> 1. Users learn to use their tools. That Just Won't Happen. Especially not in a corporate/government setting. In my experience, it's rare for people to actually want to improve how they work without there being external pressure. Workflows once learned become very, very hard to unlearn and it's already a massive issue when you are responsible for a piece of business software that's used by a hundred users - I once w…

> That Just Won't Happen.

Please, read what you quoted to the end. The answer is right there.

Anyways. Here are examples to the contrary: cars and driving. Somehow, collectively, we realized that driving requires learning the tools to a minimal proficiency level. This doesn't prevent anyone from driving a car w/o a license (a document certifying one's learned the tools), but it puts the blame for a certain category of accidents on the driver, thus making it unnecessary to demand absolute road safety from car manufacturers.

What if we treated computers more like cars? Perhaps, in a situation like this, products s.a. VSCode wouldn't even exist in the same way how there aren't cars that don't come equipped with safety belts?

Right now, parent suggests, metaphorically, to equip cars with a system that plans the route in advance, has a required number of passengers for each planned trip and won't even open the doors unless the car reaches its destination. This is what "explicit permission system" is to a computer user lucky enough to have avoided most of the MS / Google / Apple and Co products.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#408

Post by cess11 »

Sweepi wrote: post #374
wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

Answer: Because the "random stuff" (plugins for VS Code and other IDEs) solves real problems and nothing bad happens most of the time. Almost no manager will sign-off spending time on building stuff in-house if its available "for free". This is also in no way a new thing. How much code was written in notepad++ in the '00ies? Did anyone bother to check if the plugins did sth. malicious? We also used some weird closed-…

"solves real problems and nothing bad happens most of the time."

Like Wordpress plugins previously that'll work for now but we're now on the trajectory of relearning that same lesson, because people are automating discovery and exploitation of these extensions and plugins and whatnot around text editors and MCP and so on.

Though I suspect we'll first see a torrent of exploitation similar to what was done to Wordpress instances, and then a change of behaviour, because as you allude to, the people with influence didn't learn from previous experiences with similar technologies.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#409

Post by zitterbewegung »

Sweepi wrote: post #374
wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

Answer: Because the "random stuff" (plugins for VS Code and other IDEs) solves real problems and nothing bad happens most of the time. Almost no manager will sign-off spending time on building stuff in-house if its available "for free". This is also in no way a new thing. How much code was written in notepad++ in the '00ies? Did anyone bother to check if the plugins did sth. malicious? We also used some weird closed-…

At least in my experience depending on how serious the company was about security plugin downloading would be prohibited.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#410

Post by mfro »

camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

FWIW VScode can be used in a docker container or remote server from the local client. See devcontainers and VSCode over ssh.
Post reply on HN