The Lagoon TechMy little blog in Cyberspace.

Some of my readers, especially longtime ones, may remember that I have warned multiple times about being careful which extensions you choose to install in your web browser. Installing the wrong one, especially one that contains malicious code, can compromise your computer’s security.

This time, it is a lesson on being careful which extension you install in Visual Studio Code (a.k.a. VS Code). In a nutshell, an employee at GitHub installed (or at least updated) an extension that had been contaminated with malware code. The extension then proceeded to steal the employee’s credentials and gain access to tons of GitHub’s own private repositories.

The report claimed the malware stole:

• AWS keys
• Database passwords
• Kubernetes tokens
• SSH credentials

I would venture a guess that other IP (intellectual property) was stolen too.

Additionally, even Bitwarden’s official CLI package published on npm had been compromised by this hacker group.

I will let you read the full report from X below.