Visual Studio Code

Microsoft has introduced a two-hour delay for automatic updates of Visual Studio Code extensions to mitigate software supply chain threats. This change aims to add an extra layer of protection by preventing immediate updates to newly published versions.

Ammar Askar, a bug hunter, leaked a vulnerability in Microsoft's Visual Studio Code after becoming disillusioned with the company's handling of security reports. The exploit allows attackers to steal OAuth tokens via malicious extensions, compromising GitHub repos, and was disclosed publicly due to past negative experiences with Microsoft Security Response Center (MSRC).

A security researcher disclosed a Visual Studio Code zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a malicious link. The exploit code has been released.

XLIDE is a new tool that allows users to run Visual Basic for Applications (VBA) code in Visual Studio Code without requiring Excel. The project, hosted on GitHub by WilliamSmithEdward, aims to provide a more flexible development environment for VBA automation tasks.

GitHub confirmed that 3,800 internal repositories were stolen through a poisoned Visual Studio Code extension. The breach occurred after an employee installed a malicious coding tool, giving TeamPCP access to GitHub's private source code. This incident highlights a significant security vulnerability.

GitHub internal repositories were compromised through a poisoned Visual Studio Code extension, with the company detecting and containing the compromise and rotating critical secrets. The incident underscores growing risks in software development platforms. GitHub assesses that only internal repositories were affected.

GitHub has confirmed a breach of approximately 3,800 repositories due to a malicious Visual Studio Code extension. The incident is related to an ongoing investigation into unauthorized access to GitHub's internal repositories. GitHub is working to address the issue.

GitHub was compromised due to a malicious Visual Studio Code extension, resulting in the exfiltration of internal repositories. The company is analyzing logs and monitoring for further activity. The incident has raised concerns about the security of private repositories and credentials.

GitHub experienced a breach of approximately 3,800 internal repositories due to a malicious Visual Studio Code extension installed by an employee. The breach was confirmed by GitHub. The incident highlights security concerns related to third-party extensions.

GitHub's internal repositories were breached through a Visual Studio Code extension. The breach was reported and GitHub is investigating the incident. The cause of the breach is attributed to a VS Code extension.

Visual Studio Code is automatically inserting 'Co-Authored-by Copilot' into Git commits regardless of whether GitHub Copilot was used, raising concerns about incorrect attribution. The change originated from a GitHub pull request and has sparked discussion on Hacker News.

Hackers compromised Docker images, VSCode, and Open VSX extensions for Checkmarx's KICS analysis tool to steal sensitive data from developer environments. The breach exploits the supply chain to harvest information from affected systems.