Microsoft’s VSCode Marketplace: A Comedy of Errors or Just a Ransomware Rehearsal?
Two VSCode Marketplace extensions were found harboring in-development ransomware, highlighting critical gaps in Microsoft’s review process. The extensions, downloaded a total of 15 times, included a PowerShell command to encrypt files in a test folder. The incident underscores the need for more rigorous safety checks on the platform.
Hot Take:
**_Microsoft’s VSCode Marketplace: Where extensions can be anything from a developer’s dream to a cyber nightmare! Who knew coding could be so inclusive—ranging from data scientists to, well, aspiring cybercriminals?_**
Key Points:
– Two malicious extensions, “ahban.shiba” and “ahban.cychelloworld,” were lurking in the VSCode Marketplace.
– The ransomware hidden in these extensions was still in the “test phase,” encrypting only a specific folder.
– Microsoft’s review process failed to catch these threats, leaving them online for months.
– Security researcher Italy Kruk spotted the issue earlier but received no response from Microsoft.
– The incident sheds light on Microsoft’s review inconsistencies, where they sometimes act too slow or too fast.