https://www.bleepingcomputer.com/news/security/vscode-extensions-with-9-million-installs-pulled-over-security-risks/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Microsoft confirms it's killing off Skype in May, after 14 years Microsoft confirms it's killing off Skype in May, after 14 years + VSCode extensions with 9 million installs pulled over security risks VSCode extensions with 9 million installs pulled over security risks + Vo1d malware botnet grows to 1.6 million Android TVs worldwide Vo1d malware botnet grows to 1.6 million Android TVs worldwide + Microsoft names cybercriminals behind AI deepfake network Microsoft names cybercriminals behind AI deepfake network + Qilin ransomware claims attack at Lee Enterprises, leaks stolen data Qilin ransomware claims attack at Lee Enterprises, leaks stolen data + Police arrests suspects tied to AI-generated CSAM distribution ring Police arrests suspects tied to AI-generated CSAM distribution ring + Serbian police used Cellebrite zero-day hack to unlock Android phones Serbian police used Cellebrite zero-day hack to unlock Android phones + Microsoft confirms it's killing off Skype in May, after 14 years Microsoft confirms it's killing off Skype in May, after 14 years * Tutorials + Latest + Popular + How to access the Dark Web using the Tor Browser How to access the Dark Web using the Tor Browser + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * VSCode extensions with 9 million installs pulled over security risks * * VSCode extensions with 9 million installs pulled over security risks By Bill Toulas * February 26, 2025 * 02:10 PM * 0 VSCode Microsoft has removed two popular VSCode extensions, 'Material Theme - Free' and 'Material Theme Icons - Free,' from the Visual Studio Marketplace for allegedly containing malicious code. The two extensions are very popular, having been downloaded nearly 9 million times in total, with users now receiving alerts in VSCode that the extensions have automatically been disabled. The publisher, Mattia Astorino (aka equinusocio), has multiple extensions on the VSCode marketplace, totaling over 13 million installs. News of the extensions being malicious comes from cybersecurity researchers Amit Assaraf and Itay Kruk, who have expertise in scanning VSCode for malicious extensions. In a report published today, the researchers say they discovered suspicious code in the extensions and reported their findings to Microsoft. "Microsoft removed both extensions from the VS Code marketplace and banned the developer," reads a post from a Microsoft employee to YCombinator's Hacker News. "A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code." "We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instances that have this extension running. For clarity - the removal had nothing to do about copyright/licenses, only about potential malicious intent." VSCode automatically removing Material Theme extensionsVSCode automatically removing Material Theme extensions Source: bsdahl The researchers told BleepingComputer that their specialized scanner detected malicious activity in the extension's code. One of the researchers, Amit Assaraf, says they believe the malicious code was introduced in an update to the extensions, indicating either a supply chain attack through a dependency or the developer's account was compromised. Scanner's risk score evaluationScanner's risk evaluation for Material Theme Source: app.extensiontotal.com Moreover, they explained that themes should be static JSON files and not execute any code, so this behavior was marked as suspicious in their evaluation. As verified by BleepingComputer, the "release-notes.js" files in the theme contain heavily obfuscated JavaScript, which is always a red flag in open-source software. Obfuscated code in the extensionHeavily obfuscated JavaScript in release-notes.js file Source: BleepingComputer A partial deobfuscation of the code showed numerous references to usernames and passwords. However, as the file was still heavily obfuscated, BleepingComputer could not determine in what way they were being referenced. Microsoft says they will publish more details about the extension and any detected malicious activity to the VSMarketplace GitHub repository soon. The developer of the extensions, Mattia Astorino (aka equinusocio), responded to concerns about the extensions being malicious, stating that the issues are caused by outdated Sanity.io dependency that "looks compromised." "Dear @gegtor nothing harmful was ever shipped within Material Theme.," reads a post from Astorino in Microsoft's VSMarketplace repository. "We just had an outdated sanity.io dependency used since 2016 to show release notes from sanity headless CMS, that was the only issue they found." "That dependency has been there since 2016 and passed every check since then, now it looks compromised but NO ONE from Microsoft reached us to remove it. They just pulled down everything causing issues to millions of users, and causing a loop in vscode (yep, it's their fault)" "They broke everything without ever reaching out to us for clarification. Removing the old dependency was a quick 30-second fix, but it seems that's just how Microsoft operates. We also ship an obfuscated index.js file that contains all the theme commands and logic. It's obfuscated because the extension is now closed-source; however, if you delete it, the extension will still function with plain JSON files." Until the situation clears up and it's determined whether or not the extensions are malicious, it is recommended to remove the following from all projects: * equinusocio.moxer-theme * equinusocio.vsc-material-theme * equinusocio.vsc-material-theme-icons * equinusocio.vsc-community-material-theme * equinusocio.moxer-icons The developer, Astorino, later published what they claim is a "completely rewritten extension" without any dependencies named "Fanny Themes" to the VSCode Marketplace, which Microsoft subsequently removed. In response to our questions about the obfuscated release-notes.js file, Astorino repeated what he posted to GitHub, stating that a @sanity dependency was compromised and could have been quickly removed if he had been notified. "The release notes file was made and used to generate a web view to show changes from sanity.io, an headless cms, back in 2016," Astorino told BleepingComputer. "Never touched it since then, as I was focused on the new version of the extension. The only harmful thing was the old (and only) @sanity dependency which has been compromised. But i didn't know it." Related Articles: Microsoft confirms it's killing off Skype in May, after 14 years Microsoft names cybercriminals behind AI deepfake network Windows 11 KB5052093 update released with 33 changes and fixes Microsoft to remove the Location History feature in Windows Firefox continues Manifest V2 support as Chrome disables MV2 ad-blockers * Developer Environment * Extensions * Microsoft * Obfuscation * Theme * VS Code * VSCode * * * * * Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * Orange Orange Group confirms breach after hacker leaks company documents * Hacker data theft Have I Been Pwned adds 284M accounts stolen by infostealer malware * pirate flag red PyPi package with 100K installs pirated music from Deezer for years Sponsor Posts * Overdue a password health-check? Audit your Active Directory for free * 5 Browser Security Threats Overlooked by Security Tools. Get the Free Report * RDP Security Simplified - No VPN, No Firewall Exposure. Get a free TruGrid business trial. * Integrating LLMs into security operations using Wazuh. Learn how to get started. * Discover full attack chains and identify their root cause. Learn more about Automated Security Validation. Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT