Mastodawn

Luke Waite 🇨🇦

Somebody sent me this blog my way today so I had a dig into it for a few hours. https://medium.com/@amitassaraf/the-story-of-extensiontotal-how-we-hacked-the-vscode-marketplace-5c6e66a0e9d7

Yes, Amit is right. Visual Studio Marketplace is a clusterfuck.

✅ anybody can verify themselves using just a domain name
✅ anybody can set any display name
✅ extensions allow RCE, no sandboxing or limits at all
✅ full access to developer + build
✅ anybody can link any GitHub repo, even if it has nothing to do with the extension
✅ I’ve already found malware - backdoors, beacons etc etc

1/6 | How We Hacked Multi-Billion Dollar Companies in 30 Minutes Using a Fake VSCode Extension

30 minutes. 30 minutes is how long it took us to develop, publish, and polish a Visual Studio Code (The most popular IDE on the planet with over 15m monthly users) extension that changes your IDE’s…

Medium

Kevin Beaumont Jun 12, 2024

There's a follow on blog post which is also relevant: https://medium.com/@amitassaraf/2-6-exposing-malicious-extensions-shocking-statistics-from-the-vs-code-marketplace-cf88b7a7f38f

I'm still digging through the extensions myself and there's a lot to unpack, there's essentially supply chain attacks there where people have replaced open source projects and nobody has even noticed.

2/6 | Exposing Malicious Extensions: Shocking Statistics from the VS Code Marketplace

In the previous blog post “1/6 | How We Hacked Multi-Billion Dollar Companies in 30 Minutes Using a Fake VSCode Extension”, we told the story of how within 30 minutes of work we created a Visual…

Medium

Kevin Beaumont Oct 24, 2024

A reminder that Visual Studio Code’s marketplace is still an absolute security clusterfuck that Microsoft have engineered.

There’s active supply chain attacks in there nobody has reported on. (That, yes, will get a cartoon porg blog on one day).

Kevin Beaumont Feb 26, 2025

Expect many more of these. VSCode is an absolute security trash fire, MS Security needs to have a word with MS.

- It installs as non-admin
- There are no security controls *at all* around marketplace access
- addons update automatically and are required
- No vetting
- Blue tick verification just needs any domain name
- Source code link on addons doesn’t need to match the addons
- Allows RCE by design
- The marketplace is absolutely riddled with malware

https://www.bleepingcomputer.com/news/security/vscode-extensions-with-9-million-installs-pulled-over-security-risks/

VSCode extensions with 9 million installs pulled over security risks

Microsoft has removed two popular VSCode extensions, 'Material Theme - Free' and 'Material Theme Icons - Free,' from the Visual Studio Marketplace for allegedly containing malicious code.

BleepingComputer

Kevin Beaumont Feb 26, 2025

Background blogs on VSCode extensions, which the author didn’t link together and basically struggled to communicate the issue widely, but the issues are definitely there.

Part 1 https://medium.com/@amitassaraf/the-story-of-extensiontotal-how-we-hacked-the-vscode-marketplace-5c6e66a0e9d7
Part 2 https://medium.com/extensiontotal/2-6-exposing-malicious-extensions-shocking-statistics-from-the-vs-code-marketplace-cf88b7a7f38f
Part 3 https://medium.com/extensiontotal/3-6-uncovering-design-flaws-in-the-visual-studio-code-marketplace-ea1d8e8b0171
Part 4 https://medium.com/extensiontotal/4-6-introducing-extensiontotal-how-to-assess-risk-in-vs-code-extensions-3ac5bfd83fb1
Part 5 https://medium.com/extensiontotal/5-6-breaking-the-internet-the-aftermath-of-our-research-2dee0a1e2498
Part 6 https://medium.com/extensiontotal/6-6-uncover-hidden-risks-cisos-guide-to-using-extensiontotal-api-for-your-organization-59fee46e6369

Follow up https://medium.com/extensiontotal/vscode-extension-trivia-real-or-cake-f729adc9e03e

1/6 | How We Hacked Multi-Billion Dollar Companies in 30 Minutes Using a Fake VSCode Extension

30 minutes. 30 minutes is how long it took us to develop, publish, and polish a Visual Studio Code (The most popular IDE on the planet with over 15m monthly users) extension that changes your IDE’s…

ExtensionTotal

vxo Feb 26, 2025

@GossiTheDog I'm both horrified and amused at how bad this is

David Chisnall (*Now with 50% more sarcasm!*)Feb 26, 2025

@GossiTheDog And the remote extension works by sshing into the target machine (e.g. your production machine), grabbing a binary of VS Code from a Microsoft server, extracting it in he home directory (neatly bypassing any auditing of installed binaries and leaving the executables writeable by the user) and then installing copies of your extensions on the target machine, where they then have the ability to run other executables and make network connections from the target machine.

Tiffany Feb 26, 2025

This whole thing has been on my mind if I want to download a VS Code extension. I'm at a point where if there's a specific need that I think an extension would improve, I ask other devs for recommendations, and use something from someone I trust. This reinforces my fears.

Kevin Boyd (he/him) 🇨🇦Feb 26, 2025

@GossiTheDog oof.

I hope the Obsidian plugin ecosystem is safer than this.

Paul 夏央 Kishimoto Feb 27, 2025

@kboyd @GossiTheDog I can't imagine why it would be.

I filed a bug once against a popular extension, only to discover (a) it had been abandoned by the author, (b) even though the author had gone to work *for* Obsidian, and (c) the shipped code was a compiled JS that had unclear relationship to the TS in the repo.

As well, Obsidian itself is not open source, so unlike VS Code/Codium it's not clear what Electron or other features may be exposed for RCE and other trickery 🙃

SensibleOtter Feb 27, 2025

It is the Internet Explorer of modern day. Not just for the reasons mentioned, but also because if someone want something they ‘just search and download’ anything.

BigLinter Feb 28, 2025

@GossiTheDog while im certainly that vscode... is ... special... this problem exists in all "modern" editors and ide's, seriously, whos checking the plugins that one could plug into notepad++? also... vundle had its moment, so did plug...

ludiusvox Feb 28, 2025

@GossiTheDog i can't wait until Theia IDE can run python fully

Michael Stanclift Oct 24, 2024

Simonoid Oct 24, 2024

ck0 Oct 24, 2024

@GossiTheDog What a surprise ...... especially since I've learned they also own the NPM repos

Conan Oct 25, 2024

@GossiTheDog from the admin side, there's sweet FA you can do to set an allow / block list either

blabaere Oct 25, 2024

@GossiTheDog I know some corporate workplaces where the easiest way, if not the only way, to download some binary is to get the matching VSCode plugin.

But maybe this is exactly what you're referring to ?

Christoph_vW Oct 25, 2024

@GossiTheDog https://github.com/microsoft/DevSkim/issues/648 We need a new song… “you have to sign it, sign it…” 😁

binaries are not digitally signed · Issue #648 · microsoft/DevSkim

Describe the bug exe and dll files in .vscode\extensions\ms-cst-e.vscode-devskim-1.0.33\devskimBinaries are not digitally signed. unsigned code is not allowed to run on our machines.

GitHub

Shadow Oct 25, 2024

@GossiTheDog Please lead us to the knowledge, much interested

Andy Wootton Feb 27, 2025

@GossiTheDog Last night I was looking at 'code' on my Linux box, thinking I never use it. Thanks for the nudge!

Christoph_vW Jun 13, 2024

@GossiTheDog Another Problem is that lots of VS-Code extensions contain unsigned DLLs. So it is not easy to harden the developer systems with AppLocker.

The Doctor Jun 12, 2024

@GossiTheDog Shit. Work is going to be fun for a few weeks.

LariscusObscurus Jun 12, 2024

@GossiTheDog This is even more fun considering that VS Code extensions update automatically by default. Publish an extension to gain trust and update to a malicious version at a later date, the auto update will guarantee that you will infect plenty of targets.

Anton 🏳️‍🌈 🇬🇷Pappas (he/him)Jun 12, 2024

@GossiTheDog I wonder what the state of CPAN is these days.

Linh Pham Jun 13, 2024

@GossiTheDog Given the verification process for Flatpaks include domain validation via hosting a .well-known file and adding attributes to a GitHub repo that you own, I wonder how much easier it is to replicate this with Flatpaks compared to VS Code extensions.

Fritz Adalis Jun 13, 2024

@GossiTheDog @Fr333k
ok but our dev process relies on darcula.

9579cfc2-3e7d-35c7-af3b-cddda26f71bd Jun 15, 2024

@GossiTheDog
calling them extensions and not plugins seems to only serve to obscure this threat

👨‍💻Feb 27, 2025

@GossiTheDog I spent some time earlier today trimming down my extensions as much as I could without impacting my productivity, with the eventual goal in mind of sticking with my own additions as I can.

Not only does it have those security problems, but also most extensions that are recommended are bloated and meaningless. Like how did I over time manage to collect 3 different plugins for Python language servers? And at some point I had a plugin made by Wix, who I have never used their software and never planned to…

Mark Hughes Feb 27, 2025

@GossiTheDog
Thanks for highlighting this.

I've removed or disabled almost all the extensions I had installed leaving a core of popular ones from official projects (I hope).

I wonder what FOSS alternatives we now have to VSC. I mainly do #RustLang and some web (mostly Svelte it plain HTML) and get a big productivity boon from syntax highlighting/checking and completion. Finding function definitions and references, global search and replace, auto fixing after file rename etc. Gosh, so much!

Kraftwerk-Das Model Collapse Feb 27, 2025

@markhughes lapce is worth a look

@markhughes
#HelixEditor, #ZedEditor, #Lapce (already mentioned), #Kate is not bad either
@GossiTheDog