Move over, npm: Trust VS Code extensions at your own risk, dev teams - ReversingLabs

VSC Marketplace FAIL: It’s super easy to spoof Visual Studio Code extensions. And it’s incredibly hard to detect.

3/ It may also be present in @VisualStudio and @AzureDevOps.

In this week’s #SSBlogwatch we run and hide.

For @ReversingLabs’ @SecuredSoftware: https://t.co/fo19rhLAoX

— @Richi 🤓 Jennings (@RiCHi) January 24, 2023