DevThe Next Webabout 2 hours ago
Extension Resurrection Exposes IDE Supply Chain Blind Spot
1 min read
Bloom Security found 677 of 4,179 VS Code packs and 94 of 321 Open VSX packs could let attackers claim missing extension namespaces, affecting 500,000+ downloads. Microsoft and the Eclipse Foundation implemented protections after disclosure. IDE extensions run with Node.js host access, enabling file writes and network requests.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
