VSCode extensions with 9 million installs pulled over security risks
https://www.bleepingcomputer.com/news/security/vscode-extensions-with-9-million-installs-pulled-over-security-risks/Open linkView original on sh.itjust.workshttps://www.bleepingcomputer.com/news/security/vscode-extensions-with-9-million-installs-pulled-over-security-risks/Open linkView original on sh.itjust.works
Mattia Astorino’s ‘Material Theme – Free' and 'Material Theme Icons – Free‘ plugins for anyone curious.
Of course it's material theme stuff. Smh.
Lmao, Microsoft clearly says themes arent allowed to use scripts and the first thing this jackass does is admit to use obfuscated scripts in his theme. What a dick.
That sounds incredibly easy to enforce, why didn't they?
Because Microsoft hates you
Because people will do the work for them, so why enforce their TOS when they can just say YMMV and have absolutely zero liability if someone's extension sells your corporate code to the dark web
You can still have zero liability with a simple automated check. A theme is just JSON, so if it's in the theme category, run it through a JSON parser.
That would take a bad developer a day to do.
The guy is an absolute twat, don’t believe a word he says.
https://m.youtube.com/watch?v=3wz7YF2as-c&pp=ygUQVGhlbyBnZyBtYXRlcmlhbA%3D%3D