4 ms·

So which extension? Why don't they tell us?

vldszn 5mo ago
There are rumours that was NX Console VS code extension https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...
- raverbashing 5mo ago
  Sounds like another "why even bother" extension, made to automate things that shouldn't be automated
- vldszn 5mo ago
  [dead]
- vldszn 5mo ago
  UPD: it’s confirmed now by the CEO of Nx https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_RN2fQnPTv5buAq00Oxwaw https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_...
  - bmandale 5mo ago
    > One of our developers was compromised by a recent supply-chain compromise on Tanstack ...which in turn was caused by bad design of github's CI pipeline. Funny how it all comes back around like that.
    - vldszn 5mo ago
      Yeah..full circle
cmg 5mo ago
A few days ago I saw I had an update to the Twig extension. The UI flagged it as having new executable code in the update bundle, so I didn't install the update, disabled the extension as I wasn't working on Drupal views that day, and went about my work. I didn't have time to investigate the new update's contents. When I went back to the extension page, it was taken down: https://open-vsx.org/extension/whatwedo/twig https://open-vsx.org/extension/whatwedo/twig I'm not saying it was whatwedo.twig, but I'm not saying it wasn't, either. Edit: If anyone's got a good recommendation for a twig formatter for Cursor / VS Code, please let me know.
- james2doyle 5mo ago
  I’ve used djlint on a liquid project and it worked well. It supports twig too: https://djlint.com/docs/languages/twig/ https://djlint.com/docs/languages/twig/ They also have an online demo/playground so you can at least give it a shot to see if it works. I’ve used the twiggy LSP before and there seems to be a few VS code extensions for it: https://marketplace.visualstudio.com/items?itemName=moetelo.twiggy https://marketplace.visualstudio.com/items?itemName=moetelo.... and https://marketplace.visualstudio.com/items?itemName=Stanislav.vscode-twig https://marketplace.visualstudio.com/items?itemName=Stanisla...
- nightpool 5mo ago
  I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo.twig https://marketplace.visualstudio.com/items?itemName=whatwedo... I wonder if it was open-vsx specific?
  - cmg 5mo ago
    That’s very possible. I switch between Cursor and VS Code, don’t remember which it was that day.
    - Lyrkan 5mo ago
      I think I checked a few weeks ago and whatwedo.twig was not on OpenVSX at that time, so I'm suspecting it is a case of name-squatting. This seems to be confirmed here: https://socket.dev/openvsx/package/whatwedo.twig/versions/1.2.8?platform=universal https://socket.dev/openvsx/package/whatwedo.twig/versions/1....
Atotalnoob 5mo ago
It’s nx console https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w https://github.com/nrwl/nx-console/security/advisories/GHSA-...

There are rumours that was NX Console VS code extension https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...

raverbashing 5mo ago
Sounds like another "why even bother" extension, made to automate things that shouldn't be automated
vldszn 5mo ago
[dead]
vldszn 5mo ago
UPD: it’s confirmed now by the CEO of Nx https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_RN2fQnPTv5buAq00Oxwaw https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_...
- bmandale 5mo ago
  > One of our developers was compromised by a recent supply-chain compromise on Tanstack ...which in turn was caused by bad design of github's CI pipeline. Funny how it all comes back around like that.
  - vldszn 5mo ago
    Yeah..full circle

cmg 5mo ago

A few days ago I saw I had an update to the Twig extension. The UI flagged it as having new executable code in the update bundle, so I didn't install the update, disabled the extension as I wasn't working on Drupal views that day, and went about my work. I didn't have time to investigate the new update's contents. When I went back to the extension page, it was taken down: https://open-vsx.org/extension/whatwedo/twig https://open-vsx.org/extension/whatwedo/twig I'm not saying it was whatwedo.twig, but I'm not saying it wasn't, either. Edit: If anyone's got a good recommendation for a twig formatter for Cursor / VS Code, please let me know.

james2doyle 5mo ago
I’ve used djlint on a liquid project and it worked well. It supports twig too: https://djlint.com/docs/languages/twig/ https://djlint.com/docs/languages/twig/ They also have an online demo/playground so you can at least give it a shot to see if it works. I’ve used the twiggy LSP before and there seems to be a few VS code extensions for it: https://marketplace.visualstudio.com/items?itemName=moetelo.twiggy https://marketplace.visualstudio.com/items?itemName=moetelo.... and https://marketplace.visualstudio.com/items?itemName=Stanislav.vscode-twig https://marketplace.visualstudio.com/items?itemName=Stanisla...
nightpool 5mo ago
I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo.twig https://marketplace.visualstudio.com/items?itemName=whatwedo... I wonder if it was open-vsx specific?
- cmg 5mo ago
  That’s very possible. I switch between Cursor and VS Code, don’t remember which it was that day.
  - Lyrkan 5mo ago
    I think I checked a few weeks ago and whatwedo.twig was not on OpenVSX at that time, so I'm suspecting it is a case of name-squatting. This seems to be confirmed here: https://socket.dev/openvsx/package/whatwedo.twig/versions/1.2.8?platform=universal https://socket.dev/openvsx/package/whatwedo.twig/versions/1....

Atotalnoob 5mo ago

It’s nx console https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w https://github.com/nrwl/nx-console/security/advisories/GHSA-...