3 ms·

Using non-printable characters to encode malicious code is creative, but I wouldn't say it "breaks our security model". I would be pretty suspicious if I saw a

Using non-printable characters to encode malicious code is creative, but I wouldn't say it "breaks our security model". I would be pretty suspicious if I saw a large string of non-printable text wrapped in a decode() function during code review... Hard to find a legitimate use for encoding things like this. Also another commenter[1] said there's an eval of the decoded string further down the file, and that's definitely not invisible. Has no one thought to review the AI slop before publishing? [1] https://news.ycombinator.com/item?id=45649224 https://news.ycombinator.com/item?id=45649224

codebje 1y ago
There's no self-propagation happening, that's just the terrible article's breathless hyping of how devastating the attack is. It's plain old deliberately injected and launched malware. OpenVSX is a huge vector for malicious actors taking real Marketplace extensions, injecting a payload, and uploading them. The article lists exactly one affected Marketplace extension, but that extension does not exist. > Has no one thought to review the AI slop before publishing? If only Koi reviewed their AI slop before publishing :(