A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to "infect" over 100 organizations by trojanizing a copy of the popular 'Dracula Official theme to include risky code. Further research into the VSCode Marketplace found thousands of extensions with millions of installs.
    • 30p87@feddit.de
      163·
      2 years ago

      But why can a theme make web requests?!

      Why can a Word or Excel file execute shell code? Why does M$ SQL Server have xp_cmdshell?

      Because we live in a broken world and nothing matters.

      Because devs chose to live in this part of the world, dictated by M$ and other large companies, who just don’t care.