Microsoft has removed two popular VSCode extensions, “ Material Theme – Free ” and “ Material Theme Icons – Free ,” from the Visual Studio Marketplace, as they were said to contain malicious code.
The extensions in question are very popular with nearly 9 million downloads in total. However, users are now receiving notifications in VSCode that the extensions have been disabled.
The news that the extensions are malicious was first reported by cybersecurity researchers Amit Assaraf and Itay Kruk, who scan VSCode for malicious elements. The researchers said they discovered suspicious code in the extensions and reported their findings to Microsoft.
Microsoft removed both extensions from the VSCode marketplace and banned the developer.
“A community member did a deep security analysis of the extension and found several red flags indicating malicious intent and reported it to us. Our security researchers at Microsoft confirmed these claims and found additional suspicious code,” the company said.
See also: Malicious JavaScript: What it is and how to protect yourself
“We have blocked the publisher from the VS Marketplace and removed all of its extensions. We have also uninstalled them from all VS Code instances. The removal had nothing to do with copyright/licenses, but only with possible malicious intent.“.
Researchers told BleepingComputer that their specialized scanner detected malicious activity in the code. Amit Assaraf says the malicious code was likely introduced in an extension update, indicating either a supply chain attack via a dependency or a compromise of the developer's account.
Additionally, they explained that themes should be static JSON files and not execute any code, so this behavior was flagged as suspicious in their evaluation.
At the same time, BleepingComputer says that the “release-notes.js” files in the theme contain obfuscated JavaScript, which is considered a red flag in open source software.
Microsoft says it will publish more details about the extensions and any malicious activity on the VSMarketplace GitHub repository.
The extensions' developer, Mattia Astorino (aka equinusocio), stated that the issues are caused by the outdated Sanity.io dependency that "appears to have been compromised.
“ Dear @gegtor, nothing harmful has ever been shipped to Material Theme ,” Astorino says in a post on Microsoft’s VSMarketplace repository
“It was simply an outdated sanity.io dependency that had been used since 2016 to display release notes from the sanity headless CMS. That was the only problem they found“.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Apiiro offers free scanner to detect malicious code
“This dependency has been around since 2016 and has passed every test since then. Now it seems to have been compromised, but NO ONE from Microsoft asked us to remove it. They just removed everything, causing problems for millions of vscode users (yes, it's their fault)“.
“They removed everything without contacting us for clarification. Removing the old dependency was a quick 30 second fix, but it seems like that's just how Microsoft works.“.
Until the situation is clarified and it is determined whether the VSCode extensions are malicious or not, it is recommended to remove the following from all projects:
equinusocio.moxer-theme
equinusocio.vsc-material-theme
equinusocio.vsc-material-theme-icons
equinusocio.vsc-community-material-theme
equinusocio.moxer-icons
The developer later published what he claims is a “completely rewritten extension” with no dependencies called “Fanny Themes” on the VSCode Marketplace. However, this extension was also removed by Microsoft.
See also: Hackers stole tokens from AI platform Hugging Face
Microsoft's decision to remove the 'Material Theme' and 'Material Theme Icons' extensions from the Visual Studio Marketplace may cause concern for users who rely on them for their daily work. It may cause disruptions in the workflow of developers, as they will have to find alternatives that meet their needs. This requires time and effort to search for and adapt to new extensions, which can affect their productivity.
On the other hand, users who have already installed these extensions may face security issuesif the allegations of malicious code prove to be true. This could lead to data loss or a breach of their privacy.
Source: www.bleepingcomputer.com
