[HN Gopher] Fake VS Code Extension on NPM Spreads Multi-Stage Ma...
___________________________________________________________________
Fake VS Code Extension on NPM Spreads Multi-Stage Malware
Author : tomabai
Score : 98 points
Date : 2025-02-07 06:58 UTC (3 days ago)
(HTM) web link (www.mend.io)
(TXT) w3m dump (www.mend.io)
| tomabai wrote:
| We discover a fake vscode extension that serves a multi-stage
| malware on npm, Inc.
|
| The package uses javascript obfuscation for downloading the first
| stage of the malware, than it uses a heavily obfuscated batch
| file to conntinue into the second phase.
|
| Lastly it leverages preconfigured ScreenConnect remote desktop
| installer to communicate with the compromised machine.
| axsharma wrote:
| Interesting, blogged about this Feb 5th
| https://www.sonatype.com/blog/fake-vs-code-extension-on-npm-...
| tomabai wrote:
| Nice, I also did in our website https://www.mend.io/blog/fake-
| vs-code-extension-on-npm-sprea...
| pinoy420 wrote:
| Also interesting how good Kaspersky is
| TaurenHunter wrote:
| Is it true that if you install a Cyrillic keyboard in Windows
| it stops some of those malware from installing? The theory is
| that they don't want to hack a site in their own country and
| end up getting a visit from Spetsnaz or get suicided.
| unsnap_biceps wrote:
| I run little snitch on Mac, but I don't have similar software for
| windows. Is there something folks would recommend or is the
| windows platform hostile to those sort of tools?
| wlesieutre wrote:
| I'm not running it currently but one I'm aware of is GlassWire
|
| https://www.glasswire.com/premium-features/
| nonchalantsui wrote:
| Simplewall, windows firewall control, netlimiter.
| likeabatterycar wrote:
| > is the windows platform hostile to those sort of tools
|
| No need for hyperbolics, just say you don't know.
|
| The built in Windows Firewall does this. No need to pay for a
| 3rd party magic app.
|
| Laud praise on Little Snitch all you want but Windows could
| quietly do this out of the box for two decades.
|
| 25 years ago we used ZoneAlarm and a variety of other tools.
| diggan wrote:
| > The built in Windows Firewall does this. No need to pay for
| a 3rd party magic app.
|
| I'm not a macOS user anymore, but when I was, Little Snitch
| did more than just block/allow all connections a program
| makes. You get a popup/window for each connection attempt,
| and can whitelist the process, domain, specific address, port
| and more.
|
| Is this really how Windows Firewall works? Because I've used
| Windows for more than two decades, and I only remember a
| boolean "allow/disallow" based on the program itself, when it
| tries to make a connection, then you see nothing else unless
| you manually go and dig into the configuration/rules. Have I
| been missing out on something?
| MassiveQuasar wrote:
| It is absolutely not how Windows work.
| Hikikomori wrote:
| You'll get a popup to allow it, but it's on/off. But you
| can manually create rules for each .exe as well.
| edgineer wrote:
| Windows Firewall Control, now owned by Malwarebytes, adds
| notification on connection attempt as a feature, while
| leaving windows firewall running intact.
|
| I've never been fully satisfied with software firewalls,
| but WFC comes close.
| knowitnone wrote:
| Weird, why does a search show this is from
| https://www.binisoft.org/wfc. How is this associated with
| Malwarebytes except the use of their name and logo? I
| would trust this a lot more if it was hosted by
| Malwarebytes and not a link on their forum https://forums
| .malwarebytes.com/topic/296798-malwarebytes-wi...
| unsnap_biceps wrote:
| I asked if it was hostile and asking is done because I don't
| know. I'm sorry that my wording upset you.
|
| Windows firewall does not appear to have similar features. A
| vscode extension connecting to a host I run is okay,
| connecting to a random domain is not okay and I don't see
| anything at all in windows firewall to notify me about
| individual connections. Please advise me on where this
| functionality is if I'm just missing it.
|
| And there's a lot about little snitch that I actively
| dislike, but its features are extremely useful. I'd love to
| have those on windows as well.
|
| As others have linked me similar software, I will explore
| those.
| fuzzy2 wrote:
| Windows Filtering Platform does it. Windows Firewall barely
| taps WFP's potential and definitely does not do the whole
| "ZoneAlarm" style allow/deny thing.
| jbverschoor wrote:
| I use orbstack for lightweight containers (macos docker), and
| https://github.com/jrz/container-shell for each project or
| experiment. Lightweight chrooted environments using containers.
| Firewalls only protect the network stack.
| cluckindan wrote:
| Portmaster.
| csh0 wrote:
| I have used Netlimiter on Windows in the past. It seems to have
| comparable functionality to Little Snitch
| 0cf8612b2e1e wrote:
| What's the best way to isolate VS Code+extensions? Do I have to
| fully run it in a VM? Use one of those third party flatpak builds
| (of unknown provenance) and disable networking via flatpak
| mechanisms?
| pinoy420 wrote:
| Considering vscode is itself malware. Probably nothing other
| than, yes, use a separate VM.
|
| I am an avid vscode advocate, but it is incredibly invasive and
| security ignorant.
| flubbergusto wrote:
| I think containers is the way to go. Maybe on top of VM
| (defense in depth-swiss-cheese is the only way to go imo).
| Something like Qubes can be great for VMs.
|
| https://github.com/legobeat/l7-devenv/pull/153
|
| This works for me (which I do run in VMs also, yes). A key
| thing is some secrets like GH token and signing keys are not
| available even for the IDE and code in the environment
| requiring them. Like a poor-mans HSM, made for dev, kinda. Also
| LLM assistant gets access to exactly what it needs. No more, No
| Less.
|
| You _can_ have your cake and eat it too.
|
| https://github.com/legobeat/l7-devenv
| diggan wrote:
| > I think containers is the way to go. Maybe on top of VM
| (defense in depth-swiss-cheese is the only way to go imo).
|
| If you go for a VM, why involved containers at all? What
| additional security you get from layering containers on top
| of VMs, compared to just straight up use a VM without
| containers?
| groby_b wrote:
| The theory is defense-in-depth. It's dubious if it buys you
| much, but any malware now needs a container escape _and_ a
| VM escape.
|
| In reality, if it's target malware, it will, and if it's a
| mass-spray like a simple VSCode extension, it won't have
| either. (Nigerian Prince theory: You don't want to deal
| with the security-conscious people for a mass-attack)
| jbverschoor wrote:
| Run a container/vm for your project. Use VSCode only as an
| interface. Dev containers should do this, but I don't like the
| performance. I use my own docker-powered chroot container
| thingy https://github.com/jrz/container-shell
| Havoc wrote:
| Some extensions are client side so even VM won't work for all.
| TZubiri wrote:
| Couldn't be me.
|
| Psa: reduce your installs of things from the internet
| LtWorf wrote:
| Everybody hates on linux distributions. But this sort of stuff
| happens weekly on pypi and npm and almost happened once in
| debian.
| diggan wrote:
| But on the other hand, getting a library into debian so users
| can eventually install it is also a somewhat big and lengthy
| process that takes time (and rightly so), compared to npm et
| al which amounts to "npm publish" and you're done basically.
|
| Don't get me wrong, I'm not saying one is better/worse than
| the other, but there are tradeoffs that not everyone is
| willing to make. I personally prefer the slower more
| intentional/reviewed option of package repositories like
| debian and arch, but things like npm/pypi/aur has their uses
| too.
| knowitnone wrote:
| except how "reviewed" is it? You maintain a package for
| years to gain trust and once you become trusted, you've
| introduced a backdoor that most people won't know about.
| LtWorf wrote:
| That takes years of effort and if you get found out you
| get banned immediately. It's not a very common level of
| commitment for bad actors it seems.
| userbinator wrote:
| NPM, why am I not surprised... and this broadly applies to the JS
| ecosystem.
|
| When people delegate their brains to others, their own judgment
| naturally deteriorates and it makes them much easier to fool.
| nailer wrote:
| JS/TS having code reusability isn't a problem. Other ecosystems
| don't have the same problems not because they have package
| repos just as good as npm but write everything from scratch out
| of virtue, but because they don't have package repos just as
| good as npm.
| sigzero wrote:
| > because they don't have package repos just as good as npm
|
| What? That simply is not true unless you mean "good" as in
| "good in spreading malware". lol
| twelve40 wrote:
| how um is this different from pypi or public repos in other
| languages... you could try to publish junk anywhere
| recursive wrote:
| In node projects, having more dependencies is usually seen as
| an asset, not a liability.
|
| Other than that, I don't think there's a difference. When I
| write node projects, I tend to minimize dependencies, but
| I've seen PR comments saying "you know you could just get a
| package to do that".
| cluckindan wrote:
| "Usually"?
|
| Do you have some statistics on that, or do you just feel
| that way?
| recursive wrote:
| Just feel that way. That's my anecdotal observation.
| YMMV.
| wswope wrote:
| Did you try looking before asking?
|
| I found multiple informative sources by searching "npm
| pypi dependency chain stats".
|
| Why the snark?
| Jarwain wrote:
| You may have mixed up who the commenter was replying to.
| They were specifically questioning "usually seen as an
| asset not a liability" bit
| Fauntleroy wrote:
| This is an extremely weird thing to say. I don't know a
| single node dev who _wants_ more dependencies. Anyone with
| a modicum of experience in the space knows the cost of
| bringing in more external code.
| wswope wrote:
| The lack of a batteries-included stdlib makes the JS
| ecosystem exceptionally vulnerable. PyPI is vulnerable to the
| same class of problems, but it's an order of magnitude harder
| to execute a wide-reaching supply chain attack compared to
| NPM, since the dependency trees are far shorter on average.
| diggan wrote:
| > When people delegate their brains to others, their own
| judgment naturally deteriorates and it makes them much easier
| to fool
|
| A thought as old as thoughts about thoughts are, almost:
|
| > For this invention will produce forgetfulness in the minds of
| those who learn to use it, because they will not practice their
| memory. Their trust in writing, produced by external characters
| which are no part of themselves, will discourage the use of
| their own memory within them. You have invented an elixir not
| of memory, but of reminding; and you offer your pupils the
| appearance of wisdom, not true wisdom, for they will read many
| things without instruction and will therefore seem to know many
| things, when they are for the most part ignorant and hard to
| get along with, since they are not wise, but only appear wise.
|
| The quote above is about books, from Plato's dialogue Phaedrus
| 14 (370-360 BCE). You by any chance feel the same about books
| as you feel about reusable JavaScript modules published on npm?
| lm28469 wrote:
| This plato's quote about books is too often used as something
| like: "someone smart was wrong about something once, hence
| everyone is wrong about every new thing forever"
|
| Nothing is black nor white but npm brought its fair share of
| dumb shit: https://en.m.wikipedia.org/wiki/Npm_left-
| pad_incident
| diggan wrote:
| > This plato's quote about books is too often used as
| something like: "someone smart was wrong about something
| once, hence everyone is wrong about every new thing
| forever"
|
| I mean, it is fairly similar to what parent actually wrote,
| isn't it a relevant quote in the context? You're not
| actually arguing for one way or another, but simply because
| you've seen the quote multiple times before, it doesn't
| apply, or what are you trying to say?
|
| How is the left_pad incident related to developers becoming
| easier to fool?
| seanthemon wrote:
| There should be a quote for that
| Veserv wrote:
| Not the OP, but yes. Blindly reciting and believing the
| contents of books without any discernment also makes you a
| fool.
|
| If you do not believe that, then might I interest you in
| uncritically imbibing the succulent nectar of wisdom flowing
| from the Flat Earth Society?
| mikedelfino wrote:
| My layman's understanding, based solely on the quote you
| cited, is that it criticizes books for not providing proper
| instruction -- being just pupils, readers need a tutor. The
| only way this could relate to programming libraries being
| reused is if people didn't even read the books back then,
| much like they don't read the libraries' source code right
| now.
|
| I'm by no means agreeing with the quote, nor am I against
| reusing programming libraries carelessly; I just don't see
| how the two are related.
| filoeleven wrote:
| I found it even more unsurprising that the fake extension
| targeted some crypto thing.
|
| > it has the same description as the original truffle
| extension: "Build, debug and deploy smart contracts on EVM-
| compatible blockchains."
| paulddraper wrote:
| > why am I not surprised
|
| Because VSCode and npm are popular.
|
| It's not like Ruby gems are immune to this, but they aren't as
| popular.
| j-bos wrote:
| For variety, here's an example from the Go ecosystem:
| https://arstechnica.com/security/2025/02/backdoored-package-...
| nailer wrote:
| There's a nice new site called https://daily.dev, but they keep
| bugging me to install a browser extension. The idea a website
| needs access to somewhere I make financial transactions is
| horrifying.
| dimal wrote:
| Seems like with deno, setting granular permissions for only
| what's necessary, you might be able to block an attack like this.
| I'm just getting started with deno, though, so I'm not sure, but
| it looks doable to me.
___________________________________________________________________
(page generated 2025-02-10 23:00 UTC)