2 ms·

We Hacked Multi-Billion Dollar Companies Using a Fake VSCode Extension

• palata 2y ago
  > This new approach was a huge success, quickly surpassing the then-market leader Jetbrains in monthly active users. Was it the approach or the fact that VScode is free and JetBrains is not?
• deleted 2y ago
  [deleted]
• uludag 2y ago
  The amount low-effort/low-value extensions on the VSCode extension marketplace are astonishing. Searching for "darcula" shows around 100 typo-squatting themes, who knows how many of which are malicious. I think both the distribution mechanism and the language shortcomings contribute to the problem. Users publish their extension which may or may not reflect the reported repository. Users download a bunch of amorphous JS code (perhaps compressed, perhaps obfuscated, perhaps malicious) to their machine and are at the mercy of it. If JS didn't need this build step and a user was able to download extensions directly from the Git forge, then the story would be a bit better.