Key Takeaways:
- Two malicious Microsoft Visual Studio Code (VS Code) extensions, ChatGPT – 中文版 and ChatGPT – ChatMoss（CodeMoss）, have been discovered to be siphoning developer data to China-based servers.
- The extensions have 1.5 million combined installs and are still available for download from the official Visual Studio Marketplace.
- The extensions work as expected, providing autocomplete suggestions and explaining coding errors, but also capture every file being opened and every source code modification to servers located in China without users’ knowledge or consent.
- Six zero-day vulnerabilities in JavaScript package managers like npm, pnpm, vlt, and Bun have been identified, which could be exploited to defeat security controls and execute malicious scripts.
- The vulnerabilities have been collectively named PackageGate and have been addressed in pnpm, vlt, and Bun, but npm has opted not to fix the vulnerability.
Introduction to Malicious Extensions
The discovery of two malicious Microsoft Visual Studio Code (VS Code) extensions has raised concerns about the security of developer data. The extensions, ChatGPT – 中文版 and ChatGPT – ChatMoss（CodeMoss）, have been found to be siphoning developer data to China-based servers. These extensions have 1.5 million combined installs and are still available for download from the official Visual Studio Marketplace. The extensions work as expected, providing autocomplete suggestions and explaining coding errors, but also capture every file being opened and every source code modification to servers located in China without users’ knowledge or consent.
How the Malicious Extensions Work
The malicious extensions work by capturing every file being opened and every source code modification, encoding it in Base64 format, and sending it to a server located in China. The process is triggered for every edit, and the extensions also incorporate a real-time monitoring feature that can be remotely triggered by the server, causing up to 50 files in the workspace to be exfiltrated. Additionally, the extensions include a hidden zero-pixel iframe that loads four commercial analytics software development kits (SDKs) to fingerprint the devices and create extensive user profiles. The four SDKs used are Zhuge.io, GrowingIO, TalkingData, and Baidu Analytics, all of which are major data analytics platforms based in China.
PackageGate Vulnerabilities
The discovery of the malicious extensions comes as the supply chain security company Koi Security identified six zero-day vulnerabilities in JavaScript package managers like npm, pnpm, vlt, and Bun. The flaws have been collectively named PackageGate and could be exploited to defeat security controls put in place to skip the automatic execution of lifecycle scripts during package installation. The vulnerabilities allow attackers to bypass script execution and lockfile integrity checks in the four package managers. Following responsible disclosure, the issues have been addressed in pnpm, vlt, and Bun, but npm has opted not to fix the vulnerability, stating that users are responsible for vetting the content of packages that they choose to install.
Response to PackageGate Vulnerabilities
The response to the PackageGate vulnerabilities has been mixed. Pnpm, vlt, and Bun have addressed the issues, but npm has chosen not to fix the vulnerability. A GitHub spokesperson told The Hacker News that the company is working actively to address the new issue as npm actively scans for malware in the registry. GitHub has also urged projects to adopt trusted publishing and granular access tokens with enforced two-factor authentication (2FA) to secure the software supply chain. Security researcher Oren Yomtov has advised that the standard advice to disable scripts and commit lockfiles is still worth following, but it’s not the complete picture. Until PackageGate is fully addressed, organizations need to make their own informed choices about risk.
Conclusion and Recommendations
The discovery of the malicious VS Code extensions and the PackageGate vulnerabilities highlights the importance of security in the software development process. Developers should be cautious when installing extensions and packages, and should always vet the content of packages before installing them. Organizations should also adopt trusted publishing and granular access tokens with enforced two-factor authentication (2FA) to secure the software supply chain. Additionally, developers should be aware of the potential risks of using extensions and packages from unknown or untrusted sources, and should take steps to mitigate those risks. By being aware of these risks and taking steps to mitigate them, developers can help to protect their data and prevent malicious activity.