Kevin BeaumontSomebody sent me this blog my way today so I had a dig into it for a few hours. https://medium.com/@amitassaraf/the-story-of-extensiontotal-how-we-hacked-the-vscode-marketplace-5c6e66a0e9d7
Yes, Amit is right. Visual Studio Marketplace is a clusterfuck.
✅ anybody can verify themselves using just a domain name
✅ anybody can set any display name
✅ extensions allow RCE, no sandboxing or limits at all
✅ full access to developer + build
✅ anybody can link any GitHub repo, even if it has nothing to do with the extension
✅ I’ve already found malware - backdoors, beacons etc etc
Mark Hughes
chfkch 
