Bloom Security’s Extension Resurrection Research: Uncovering a Developer Security Blind Spot
Summary
Bloom Security’s “Extension Resurrection” research reveals a potential security risk in developer ecosystems. It highlights that legitimate Visual Studio Code (VS Code) (discover more) and Open VSX extension packs may include references to non-existent extensions, creating an opening for malicious actors to publish harmful extensions under these trusted namespaces.
Key Findings
- Vulnerable Packs: 677 of 4,179 VS Code packs and 94 of 321 Open VSX packs were found to have such "Shadow Dependencies."
- Downloads: These vulnerable packs had over 500,000 combined downloads.
- Trust Model: The attack vector relies on the trust developers place in extension packs, rather than individual extensions.
- Automation Risks: Automatic updates further complicate the issue, as previously safe packs can later include malicious dependencies.
- Technical Impact: Affected extensions have Node.js host access, enabling file reading/writing, process spawning, and network requests.
The Underlying Problem
The research underscores a marketplace design problem where namespaces can be claimed even when the referenced extension no longer exists, potentially leading to security breaches.
References: