Vulnerability in Visual Studio Code Marketplace: A Deep Dive

Overview of the Discovery

Cybersecurity experts have recently uncovered a significant vulnerability in the Visual Studio Code Marketplace that enables malicious actors to repurpose the names of extensions that have been previously removed. This alarming finding was brought to light by ReversingLabs, a company specializing in software supply chain security.

The Malicious Extensions

The investigation into this loophole began when researchers identified a harmful extension called "ahbanC.shiba." This extension operates in a way similar to two other extensions—"ahban.shiba" and "ahban.cychelloworld"—that had previously been flagged for malicious activity earlier in March. All three extensions are designed to act as downloaders, retrieving a PowerShell payload from an external server. This payload encrypts files in a folder named "testShiba" located on the victim’s Windows desktop and subsequently demands a payment in the form of a Shiba Inu token, directing the victim to deposit funds into an unspecified wallet.

Similarities and Differentiation

ReversingLabs chose to investigate further due to the close resemblance between the new extension and the previously flagged one. It’s important to note that in the Visual Studio Code ecosystem, every extension is required to have a unique identifier, which combines the publisher’s name with the extension’s name. In this case, both "ahban.shiba" and "ahbanC.shiba" share similarities in their names, differing only in the publisher’s name.

Name Reuse Rules

According to the guidelines provided in Visual Studio Code documentation, the name field in the extension manifest needs to be entirely lowercase and space-free, ensuring that each name is unique. Security researcher Lucija Valentić questioned how these two extensions could end up with the same name despite these official rules. The answer lies in the fact that, once an extension is removed from the repository, the name can be reused by anyone. However, this does not apply if an author chooses to unpublish their extension.

A Similar Situation in Other Repositories

This phenomenon of name reuse is not exclusive to the Visual Studio Code Marketplace. It was also observed in the Python Package Index (PyPI) earlier in 2023. ReversingLabs noted that when a package is deleted, its name becomes available for others to use, as long as the distribution file names are different from those of the removed package. PyPI has implemented exceptions for package names that were initially associated with malicious content, a precaution that Visual Studio Code currently lacks.

Evidence of Ongoing Threats

Evidence from leaked Black Basta chat logs illustrates that threat actors are actively seeking to compromise open-source repositories by introducing ransomware libraries. These malicious libraries could extort innocent users who unknowingly install them, emphasizing the need for developers and organizations to adopt robust security practices and keep vigilant watch over software supply chain threats.

Valentić highlighted the grave implications of this loophole: the potential for anyone to hijack the name of any removed extension poses a significant security risk. If a widely-used and trusted extension is taken down, its name could easily fall into the hands of malicious entities.

Recent Malicious Packages Found

The recent analysis has also uncovered eight malicious npm packages designed to extract sensitive information from Google Chrome users on Windows systems. These packages can steal passwords, credit card details, cryptocurrency wallet information, and user cookies, transmitting this data to a specified URL or a Discord webhook as a fallback. The malicious packages, uploaded by users identified as ruer and npjun, include the following:

• toolkdvv (versions 1.1.0, 1.0.0)
• react-sxt (version 2.4.1)
• react-typex (version 0.1.0)
• react-typexs (version 0.1.0)
• react-sdk-solana (version 2.4.1)
• react-native-control (version 2.4.1)
• revshare-sdk-api (version 2.4.1)
• revshare-sdk-apii (version 2.4.1)

Tactics Employed by Threat Actors

One notable aspect of these malicious packages is the extensive use of 70 layers of obfuscation intended to conceal a Python payload engineered for data theft and exfiltration. As noted by JFrog security researcher Guy Korolevski, open-source software repositories have become prime targets in supply chain attacks. Techniques such as typosquatting and masquerading as legitimate software have become increasingly common among malicious actors.

The complexities of these multi-layered attacks highlight the urgent need for enhanced visibility within the software supply chain, rigorous automated scanning processes, and a unified source of truth for all software components to mitigate these cybersecurity risks effectively.