VSCode IDE Forks Expose Users To 'Recommended Extension' Attacks (bleepingcomputer.com)
- Reference: 0180519437
- News link: https://it.slashdot.org/story/26/01/05/1929255/vscode-ide-forks-expose-users-to-recommended-extension-attacks
- Source link: https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/
> Popular AI-powered integrated development environment solutions, such as Cursor, Windsurf, Google Antigravity, and Trae, [1]recommend extensions that are non-existent in the OpenVSX registry, allowing threat actors to claim the namespace and upload malicious extensions.
>
> These AI-assisted IDEs are forked from Microsoft VSCode, but cannot use the extensions in the official store due to licensing restrictions. Instead, they are supported by OpenVSX, an open-source marketplace alternative for VSCode-compatible extensions. As a result of forking, the IDEs inherit the list of officially recommended extensions, hardcoded in the configuration files, which point to Microsoft's Visual Studio Marketplace.
[1] https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/
Open core software problem - need clean forks (Score:2)
This shows the danger of forgetting ideology and politics* in your software development and more importantly purchasing. In order to safely use an open core product like VScode or RedHat using a fork is absolutely crucial but it's not enough. You need a project like Rocky Linux or VSCodium and that project needs to be seriously supported to rip out all trace of the upstream vendor. The other forks then need to fork from that fork not the original. Someone needs to care about getting full control of the soft
Re: (Score:2)
What the hell are you ranting about? The exploit is because the forks overloaded .vscode/extensions.json to work on both OpenVSX and MS repos. The forks just need a different filename like .vscode/openvsk.json. It's not ideology and politics, it's "oops, didn't think of that".
LLMs making shit up? (Score:1)
Tell me it ain't so!
Re: (Score:1)
Well, it shows you didn't read the article, because that's not what's happening.