4 ms·
Before we all conclude that supply chain attacks only happen on NPM, last time I used VS Code I discovered that it auto-installed, with no apparent opt-out, Pyt
by strogonoff 1y ago
Before we all conclude that supply chain attacks only happen on NPM, last time I used VS Code I discovered that it auto-installed, with no apparent opt-out, Python typing stubs for any package (e.g., Django in my case) from whatever third-party, unofficial PyPI accounts it saw fit. (Yes, this is why it was the last time I used VS Code.)
The obscurity of languages other than JavaScript will only work as a security measure for so long.
- maleldil 1y agoI've never seen Pylance automatically install anything. Are you talking about the stubs that come packaged with Pylance, which Microsoft maintains?
- strogonoff 1y agoIt was the Microsoft’s official Python extension, as far as I recall. It was possible to use some other extension for typechecking but there were some other issues with it. (Now everything works perfectly in Neovim, and my setup respects to only use typing stubs I specify in the project.)
- maleldil 1y agoThe Microsoft official Python extension uses Pylance, which is a closed-source extension of Pyright with additional features such as built-in type stubs. This is probably what you saw.
- strogonoff 1y agoIf they were truly built-in I would not mind, but I found a bunch of third-party stubs in a dependency tree of the virtual Python environment VSC created (and ran obviously unsandboxed). What’s worse is that stubs, in addition to not being specified by me, were often pulled at the wrong version compared to the package I was using, leading to typing mismatches and runtime errors.