Hacker News Reader

Comment by mrweasel | Hacker News Reader

You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.

This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.

View on HN

What would be the careful way of installing the official extension?

That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.

> You could download the extension, diff it against the previous version and read all the code.

This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.

The CTA flavor of the year for dev tools is cURLing some arbitrary install script and run it immediately which always sounded ridiculous to me. If instead that script first pipes into claude -p for a basic vulnerability scan before continuing, I would be delighted.

Hopefully a well-sandboxed claude -p.

LLM are not designed for that. Unless prompt injection is really solved I would avoid showing LLM untrusted code.

Cursor explicitly claims "Before an extension is shown in search or served as a download, Cursor runs automated malware and supply-chain analysis using commercial security tooling. Extensions that fail review are blocked. Cursor also monitors extension-ecosystem threat intelligence and updates its blocklist over time."

However, the bad extension was live for ~11 hours.

That's a testament to the strength of their so called "commercial quality" security tooling.

Norton Anti Virus...

I recommend moving to VSCodium and using this extension:

https://github.com/jeanp413/open-remote-ssh

and run vscode-server inside a VM or container

Would that really help, if you install the extension it's running in the VSCodium instance on your machine... or is it running in the vscode-server?

Most extensions run in vscodium-server, extensions run either as "Local Extensions" that run on the host and "Remote Extensions" that run on the guest. You can clearly see in the UI which ones run where.

I only have a single "Local Extension" and it is open-remote-ssh itself.

Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.

When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.

You disable extension auto updates and then manually install every so often (and only update/install when the version has been out for 3+ days).

Reply on news.ycombinator.com