| Work | https://secureannex.com |
| Blog | https://johntuckner.me/pages/about |
| Location | KC |
Now available is the Secure Annex MCP server!
Many folks who review extensions just eyeball the marketplace listing and hope for the best. Now it is as easy as asking what threats an extension presents to your organization.
The tool has access to all context from the marketplace, enrichment data, and even files in the extension.
Setup details at https://app.secureannex.com/settings/updates
Great research by @tuckner about Mellowtel, a company that sells bandwidth of extension users: https://secureannex.com/blog/mellow-drama/
It allows a surprising amount of functionality, including many which can be abused by bad actors. Mellowtel is also associated with other entities, such as Olostep and some self-developed extensions.
Two more malicious extensions in Open VSX. Signs point to them being published without malware and then an update pushed shortly after.
nomicfdn.hardhat-solidity
juan-blanco.solidity
Both execute on install and run a 'Modal' function with 'hexColors' values. Decoding the payload shows they retrieve and execute scripts for Mac and Windows from -
p92nd[.]pages[.]dev
which does not resolve anymore
Miss earlier reporting? Catch up.
How are these extensions so easily installed in a code editor like Cursor? A couple ways.
Alesandro Ortiz 🇵🇷🏳️🌈
