shadow-ninja

3 ms·

1. 1.▲
   Fable 5 Released and Suddenly I'm Much More Paranoid About My VSCode Extensions(medium.com)

   4 points by shadow-ninja 4mo ago|0 comments
2. 2.▲
   How to Check If a VSCode Extension Is Safe Before You Install It(medium.com)

   1 points by shadow-ninja 4mo ago|0 comments
3. 3.▲
   by shadow-ninja 9mo ago

   The extension chatgpt-china by WhenSunset was flagged by vscan.dev as critical risk since the trojan.corgi/malcorgi threatw as detected. The extension has 1.3 million users, posing a significant risk to each individual.
4. 4.▲
   Caught Trojan Malware in VSCode Extension with 1.3M Downloads(vscan.dev)

   4 points by shadow-ninja 9mo ago|1 comments
5. 5.▲
   by shadow-ninja 9mo ago

   Microsoft only started really cracking down on malicious extensions relatively recently (<1 year ago). Despite their best efforts, the marketplace is getting increasingly dangerous. The list published here is of malicious extensions that
6. 6.▲
   The Concerning Amount of Malware on the VS Code Marketplace(github.com)

   27 points by shadow-ninja 9mo ago|3 comments
7. 7.▲
   Novel Security Framework for VSCode Extensions: Automated Runtime Sandboxing(nhsjs.com)

   1 points by shadow-ninja 10mo ago|1 comments
8. 8.▲
   by shadow-ninja 10mo ago

   I published a paper to solve the "unrestricted access" dangerous VSCode Extensions have. The paper outlines a 3-part automated system: 1. Risk profile VS Code Extensions 2. Generate per-extension sandboxing policies automatically
9. 9.▲
   A Self-Propagating Worm Is Hitting VSCode Extensions Right Now(dev.to)

   1 points by shadow-ninja 1y ago|0 comments
10. 10.▲
    by shadow-ninja 1y ago

    Hm all the links seem to work for me on chrome. Could you let me know which specific link isn't working (is it just for that extension or for all extensions?). I restricted it to one expanded at a time since more than one felt a bit cr
11. 11.▲
    by shadow-ninja 1y ago

    Oh yeah that's a really good idea. That would make it much easier for someone to use, though that many extensions would take a while. I would need to build up some more robust architecture before I could implement that.
12. 12.▲
    by shadow-ninja 1y ago

    Thanks for the feedback. I am constantly trying to refine the scoring metrics to make sure that these popular extensions that often need high permissions aren't flagged as a lower score than they should receive. It is a bit difficult t
13. 13.▲
    by shadow-ninja 1y ago

    Thanks for the suggestion. I was thinking about making this into a chrome web extension that people can use on a marketplace page or even using MCP to make this tool really accessible for Cursor and Windsurf users. As for the raw name, most
14. 14.▲
    Show HN: VSCan - Detect Malicious VSCode Extensions(vscan.dev)

    52 points by shadow-ninja 1y ago|27 comments