vsmarketplace

and yet, there are many malware extensions per day that get through: https://github.com/microsoft/vsmarketplace/blob/main/Removed...

It's worth noting the code is illegally relicensed without permission from copyright holders. The author is acting in bad faith. https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you Also, > obfuscated code which spawns child processes to download data for unnecessary reasons https://github.com/microsoft/vsmarketplace/issues/1168#issue... No one in the right mind would expect a theme to do this. Its only purpose is to provide static data to the editor.

Direct link to the comment with the new information (apparently it is not possible to keep the URL fragment): https://github.com/microsoft/vsmarketplace/issues/1168#issue... The gist of it: > The publisher account for Material Theme and Material Theme Icons (Equinusocio) was mistakenly flagged and has now been restored. Previous discussion here, which is also the reason why I think this resolution is relevant as well: https://news.ycombinator.com/item?id=43178831

Previous thread: https://news.ycombinator.com/item?id=43178831 Dev's complaint: https://github.com/microsoft/vsmarketplace/issues/1173 Apparently that extension had 5M installs prior to being removed.[0] It was only just released in 2021, btw; there's another Material Icon Theme you might be thinking of that's been around since 2016 and has 28M installs.[1] [0]: https://web.archive.org/web/20241220084427/https://marketpla... [1]: https://marketplace.visualstudio.com/items?itemName=PKief.ma...

It appears Microsoft released their 'detailed announcement' - it's just a one-sentence fragment in a Markdown file: https://github.com/microsoft/vsmarketplace/blob/main/Removed... I'm increasingly suspecting there was nothing actually wrong with the extension, and Theo and others may have simply demolished an open-source developer's reputation primarily because they found him difficult to collaborate with. This is nuts.

> Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/ Hi Isidor, excited for this! At Open VSX, we'd love to take a look and potentially flag the extension as malicious on our side as well. Are you aware of the version range that the malicious code was included in? I'm asking because https://open-vsx.org does not have any version published since the extension went closed-source.

Hi - Isidor here from the VS Code team. A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code. We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instances that have this extension running. For clarity - the removal had nothing to do about copyright/licenses, only about potential malicious intent. Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/ As a reminder, the VS Marketplace continuously invests in security. And more about extension runtime trust can be found in this article https://code.visualstudio.com/docs/editor/extension-ru