Skip to content

Comment on Malicious VSCode extensions with installs discovered

Comments

And my colleagues laugh at me for using Apple provided vim with no extensions for everything…

One of the reasons I never use Browser extensions either. If it doesn't ship with the browser, it cannot be trusted. NO exceptions.

There is an obvious exception: if you control the code. Many extensions have github repos where you can clone them and build your own version.

I have a long running personal extension where I collect all the functionality I need from open source extensions. Audit once, run forever with minor API updates every few years. The only third party ones I run are uBlock Origin and 1Password's official extension. With ChatGPT the audit/integration process has become loads simpler.

I even have a native extension bridge like 1password to interact with a Rust agent (to save and index visited pages, etc.)

Mozilla audits the code of the most popular Firefox extensions and tags them.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.