Microsoft has removed two popular VSCode extensions, 'Material Theme – Free' and 'Material Theme Icons – Free,' from the Visual Studio Marketplace for allegedly containing malicious code. One of the researchers, Amit Assaraf, says they believe the malicious code was introduced in an update to the extensions, indicating either a supply chain attack through a dependency or the developer's account was compromised. "Microsoft removed both extensions from the VS Code marketplace and banned the developer," reads a post from a Microsoft employee to YCombinator's Hacker News. The developer, Astorino, later published what they claim is a "completely rewritten extension" without any dependencies named "Fanny Themes" to the VSCode Marketplace, which Microsoft subsequently removed. In response to our questions about the obfuscated release-notes.js file, Astorino repeated what he posted to GitHub, stating that a @sanity dependency was compromised and could have been quickly removed if he had been notified. News of the extensions being malicious comes from cybersecurity researchers Amit Assaraf and Itay Kruk, who have expertise in scanning VSCode for malicious extensions. "We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instances that have this extension running. In a report published today, the researchers say they discovered suspicious code in the extensions and reported their findings to Microsoft. The researchers told BleepingComputer that their specialized scanner detected malicious activity in the extension's code. The publisher, Mattia Astorino (aka equinusocio), has multiple extensions on the VSCode marketplace, totaling over 13 million installs. Microsoft says they will publish more details about the extension and any detected malicious activity to the VSMarketplace GitHub repository soon. "Dear @gegtor nothing harmful was ever shipped within Material Theme.," reads a post from Astorino in Microsoft's VSMarketplace repository.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 26 Feb 2025 19:20:15 +0000