8 ms·
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
- tomabai 2y agoWe discover a fake vscode extension that serves a multi-stage malware on npm, Inc. The package uses javascript obfuscation for downloading the first stage of the malware, than it uses a heavily obfuscated batch file to conntinue into the second phase. Lastly it leverages preconfigured ScreenConnect remote desktop installer to communicate with the compromised machine.
- deleted 2y ago[deleted]
- axsharma 2y agoInteresting, blogged about this Feb 5th https://www.sonatype.com/blog/fake-vs-code-extension-on-npm-uses-altered-screenconnect-utility-as-spyware https://www.sonatype.com/blog/fake-vs-code-extension-on-npm-...
- pinoy420 2y agoAlso interesting how good Kaspersky is
- phatfish 2y agoI suspect it's a case of "don't bite the hand that feeds". Kaspersky endpoint installs are probably 99% within Russia.
- tomabai 2y agoNice, I also did in our website https://www.mend.io/blog/fake-vs-code-extension-on-npm-spreads-multi-stage-malware/ https://www.mend.io/blog/fake-vs-code-extension-on-npm-sprea...
- TaurenHunter 2y agoIs it true that if you install a Cyrillic keyboard in Windows it stops some of those malware from installing? The theory is that they don't want to hack a site in their own country and end up getting a visit from Spetsnaz or get suicided.
- assanineass 2y ago[dead]
- deleted 2y ago[deleted]
- assanineass 2y ago[dead]
- unsnap_biceps 2y agoI run little snitch on Mac, but I don't have similar software for windows. Is there something folks would recommend or is the windows platform hostile to those sort of tools?
- wlesieutre 2y agoI'm not running it currently but one I'm aware of is GlassWire https://www.glasswire.com/premium-features/ https://www.glasswire.com/premium-features/
- nonchalantsui 2y agoSimplewall, windows firewall control, netlimiter.
- likeabatterycar 2y ago> is the windows platform hostile to those sort of tools No need for hyperbolics, just say you don't know. The built in Windows Firewall does this. No need to pay for a 3rd party magic app. Laud praise on Little Snitch all you want but Windows could quietly do this out of the box for two decades. 25 years ago we used ZoneAlarm and a variety of other tools.
- diggan 2y ago> The built in Windows Firewall does this. No need to pay for a 3rd party magic app. I'm not a macOS user anymore, but when I was, Little Snitch did more than just block/allow all connections a program makes. You get a popup/window for each connection attempt, and can whitelist the process, domain, specific address, port and more. Is this really how Windows Firewall works? Because I've used Windows for more than two decades, and I only remember a boolean "allow/disallow" based on the program itself, when it tries to make a connection, then you see nothing else unless you manually go and dig into the configuration/rules. Have I been missing out on something?
- Hikikomori 2y agoYou'll get a popup to allow it, but it's on/off. But you can manually create rules for each .exe as well.
- 0cf8612b2e1e 2y agoWhat’s the best way to isolate VS Code+extensions? Do I have to fully run it in a VM? Use one of those third party flatpak builds (of unknown provenance) and disable networking via flatpak mechanisms?
- pinoy420 2y agoConsidering vscode is itself malware. Probably nothing other than, yes, use a separate VM. I am an avid vscode advocate, but it is incredibly invasive and security ignorant.
- flubbergusto 2y agoI think containers is the way to go. Maybe on top of VM (defense in depth-swiss-cheese is the only way to go imo). Something like Qubes can be great for VMs. https://github.com/legobeat/l7-devenv/pull/153 https://github.com/legobeat/l7-devenv/pull/153 This works for me (which I do run in VMs also, yes). A key thing is some secrets like GH token and signing keys are not available even for the IDE and code in the environment requiring them. Like a poor-mans HSM, made for dev, kinda. Also LLM assistant gets access to exactly what it needs. No more, No Less. You can have your cake and eat it too. https://github.com/legobeat/l7-devenv https://github.com/legobeat/l7-devenv
- diggan 2y ago> I think containers is the way to go. Maybe on top of VM (defense in depth-swiss-cheese is the only way to go imo). If you go for a VM, why involved containers at all? What additional security you get from layering containers on top of VMs, compared to just straight up use a VM without containers?
- groby_b 2y agoThe theory is defense-in-depth. It's dubious if it buys you much, but any malware now needs a container escape and a VM escape. In reality, if it's target malware, it will, and if it's a mass-spray like a simple VSCode extension, it won't have either. (Nigerian Prince theory: You don't want to deal with the security-conscious people for a mass-attack)
- TZubiri 2y agoCouldn't be me. Psa: reduce your installs of things from the internet
- LtWorf 2y agoEverybody hates on linux distributions. But this sort of stuff happens weekly on pypi and npm and almost happened once in debian.
- diggan 2y agoBut on the other hand, getting a library into debian so users can eventually install it is also a somewhat big and lengthy process that takes time (and rightly so), compared to npm et al which amounts to "npm publish" and you're done basically. Don't get me wrong, I'm not saying one is better/worse than the other, but there are tradeoffs that not everyone is willing to make. I personally prefer the slower more intentional/reviewed option of package repositories like debian and arch, but things like npm/pypi/aur has their uses too.
- knowitnone 2y agoexcept how "reviewed" is it? You maintain a package for years to gain trust and once you become trusted, you've introduced a backdoor that most people won't know about.
- LtWorf 2y agoThat takes years of effort and if you get found out you get banned immediately. It's not a very common level of commitment for bad actors it seems.
- aucisson_masque 2y agoThere are different type of bad actors, some are ready to invest heavily, meaning time and money, some are there only to make a quick buck.
- userbinator 2y agoNPM, why am I not surprised... and this broadly applies to the JS ecosystem. When people delegate their brains to others, their own judgment naturally deteriorates and it makes them much easier to fool.
- nailer 2y agoJS/TS having code reusability isn't a problem. Other ecosystems don't have the same problems not because they have package repos just as good as npm but write everything from scratch out of virtue, but because they don't have package repos just as good as npm.
- sigzero 2y ago> because they don't have package repos just as good as npm What? That simply is not true unless you mean "good" as in "good in spreading malware". lol
- paulddraper 2y ago"Easy to use" being more descriptive. Which is a help for spreading both good code and malware.
- bolognafairy 2y agoI’d be curious to hear what you think that PyPI et al are doing that NPM should be copying. It sounds like you’re pretty knowledgeable in this area, to be comfortable making comments like this with such confidence.
- nailer 2y agoI would respond, but you have not provided any supporting arguments.
- twelve40 2y agohow um is this different from pypi or public repos in other languages... you could try to publish junk anywhere
- nailer 2y agoThere's a nice new site called https://daily.dev https://daily.dev, but they keep bugging me to install a browser extension. The idea a website needs access to somewhere I make financial transactions is horrifying.
- mdaniel 2y agoIf you haven't tried it yet, both Firefox and Chrome offer different profiles[1][2], which comes with separate cookie stores and different installed extensions. The Firefox ones have a "this one goes to 11" level stupid UX (it's about:profiles, then click on Launch in New Profile) but to make up for it they offer Containers[3] which regrettably shares the same extensions as the host browser but awesomely hard sequesters the cookie and localStorage from other containers, and from the non-container default. Many people use it for all things QA since it's painless to log in to a website (AWS, Azure, etc) using totally different credentials 1: https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles https://support.mozilla.org/en-US/kb/profile-manager-create-... 2: https://support.google.com/chrome/answer/2364824 https://support.google.com/chrome/answer/2364824 3: https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
- LauraMedia 2y agoFor what it's worth: The DailyDev plugin only has access to "https://*.daily.dev/ https://*.daily.dev/" and "https://*.dailynow.co/ https://*.dailynow.co/". It is also not required, you can just go to app.daily.dev yourself (I did not want to install the addon on my main PC)
- dimal 2y agoSeems like with deno, setting granular permissions for only what’s necessary, you might be able to block an attack like this. I’m just getting started with deno, though, so I’m not sure, but it looks doable to me.
- electrovir 2y agoNode.js now has a stable permissions model, though it's very limited compared to Deno's (I don't see anything about blocking network requests). Node also says "This feature does not protect against malicious code" https://nodejs.org/docs/latest-v22.x/api/permissions.html https://nodejs.org/docs/latest-v22.x/api/permissions.html
- __jonas 2y agoI’m a little confused, how does npm play into this? The article describes a vscode extension on vscode marketplace squatting the name of an existing extension, from how it’s worded it sounds like the extension directly contains the malware rather than being compromised through a dependency, what does it have to do with npm?
- deleted 2y ago[deleted]
- illusive4080 2y agoMaybe the vscode extension is just an npm package? I also couldn’t find the link to npm in the article.
- lolinder 2y agoThe connection appears to be simply that this is content marketing for Mend, which sells dependency vulnerability scanning software, so NPM is an important keyword for them to stuff in regardless of its relevance.
- shakna 2y agoWhilst it could just be the company's need to market their NPM scanner... The article does appear to be at least edited through AI. Which could easily bleugh out the wrong target marketplace.
- pentel-0_5 2y agoIt doesn't directly. These are malicious VS Code extensions. It's completely Microsoft's fault for poorly managing the ecosystem. They must curate extensions with security audits prior to publication and sandbox them with advertised entitlements. Without these, it's running untrusted code from the internet putting users at risk for ransomware, password and cc skimmers, data harvesting, and other malware.
- sieabahlpark 2y ago[dead]
- woodruffw 2y agoI think these types of articles should be prefaced with numbers, namely: how many downloads did the package have? How many confirmed installs were there? And so forth. Given that language package managers are intentionally open to the public, "someone uploaded malware to NPM" is not itself an interesting story. What would be interesting is whether a particular typosquatting campaign was effective, given that most appear to be caught before download counts leave "background noise" levels. Or as another framing: malware on an unrestricted index does not matter if nobody actually downloads it. What matters (and is interesting) is when the attacker manages to get nontrivial numbers of downloads to their package.
- tomabai 2y agoI get your point and agree with that, but i think that the technique used here was interesting
- kingforaday 2y agoWhat continues to amaze me is the continued lack of real-time detection "enterprise" products have on even n-day discoveries like this. Even five days passed disclosure, we still have very limited IOC signaling: 1. 212.bat.exe; 1/61; https://www.virustotal.com/gui/file/2c76036ec0869f6b41bd8f7c75cc234627a8c00ea43c49991cc30eb0b5238d40 https://www.virustotal.com/gui/file/2c76036ec0869f6b41bd8f7c... 2. haha.msi; 2/61; https://www.virustotal.com/gui/file/1b2d956e3eded3e7220e3ff61ee9d7da8b14958a178f249c466c81fbfa220a2b/detection https://www.virustotal.com/gui/file/1b2d956e3eded3e7220e3ff6... 3. MLANG.dll; 15/61; https://www.virustotal.com/gui/file/a8e7f45d67b50948929adf35ef81ceccce81e1c5fe63b78311403fc16335af07 https://www.virustotal.com/gui/file/a8e7f45d67b50948929adf35... or if you focus on network/ips/perimeter detections: 4. web.winserve[.]ru; 1/94; https://www.virustotal.com/gui/domain/web.winserve.ru https://www.virustotal.com/gui/domain/web.winserve.ru 5. scare[.]su; 3/94; https://www.virustotal.com/gui/domain/scare.su https://www.virustotal.com/gui/domain/scare.su
- pentel-0_5 2y agoThe problem with the traditional antivirus signature model is that it's reactive rather than proactive. Once it's been identified by human or automated submission for human and/or automated analysis, the damage has likely already been done if it ran on a clean machine(s) already. But that's only the fraction of malware that will ever be identified because a large but unknowable fraction goes by unidentified, perhaps for all time. (When I was a Windows SA 20 years ago, I saw all sort of customer machines infected by advanced persistent threats that used evasion without any sort of antivirus signatures because they were novel threats.) What may be scanned by N vendors and deemed "safe" today and/or 10 years from now could be in fact malware by behavior. PSA: Never run untrusted code on important machines. This might mean forbidding the use of third-party extensions for common applications until they are audited, something Microsoft clearly isn't doing.
- richjdsmith 2y agoI recently tried RubyMine IDE by jetbrains after having jumped on the VS Code bandwagon since its first beta release. It has been incredible. Instead of monkeying around for 3 hours once a month because some plugin broke, or some dependency updated and a vscode plugin wasn’t expecting this, I just code. Back in the Sublime text days, it was easy. I think I had forgotten how complex I had made VS Code. Turns out, paying someone else $120/year to deal with that complexity in an IDE is a helluva good deal at your average developers hourly pay.