Spectra Assure

failRisk: Tampering

Scanned:

Monokai Pro

Artifact:

latest

Top 1k

✨ Professional dark & light theme + icon pack, from the author of the original Monokai color scheme.

License: unknown

Published:

Publisher: monokai

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

3 dangerous develop extensions

Malware

No evidence of malware inclusion

Overview issues6 vulnerabilities0 malware0 behaviors28 dependencies0 contributors1 versions41

List of software quality issues with the number of affected components.

Policies

Info

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. However, extensions are commonly abused by threat actors to execute arbitrary commands within the development environment. It was detected that the extension code could execute commands that are not typically used by development tools. Such unusual commands resemble common threat actor tactics and are usually obscured by layers of cryptography, code obfuscation, anti-analysis features, and other detection evasion techniques.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to invoke commands that download additional content from a remote server. Attackers commonly abuse development extensions to fetch malicious payloads from public code repositories, file sharing websites, or their own infrastructure. Remotely hosted content is not immutable, allowing the attackers to change the type of malware they deploy at any time.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to execute commands that can collect sensitive system information. Attackers often abuse development extensions to run commands that collect identifiable system information such as hostnames, user names, folder structures, and other data points that could help them understand the environment in which their malicious code was loaded.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. One or more embedded URLs were discovered to link to raw files hosted on GitHub. Attackers often abuse popular web services to host malicious payloads. Since code-sharing service URLs are typically allowed by security solutions, using them for payload delivery increases the odds that the malicious code will reach the user. While the presence of code-sharing service locations does not imply malicious intent, all of their uses in a software package should be documented and approved. An increasing number of software supply chain attacks in the open source space leverage the GitHub service to deliver malicious payloads.

Prevalence in Visual Studio Code community

79 packages

found in

Top 100

622 packages

found in

Top 1k

4233 packages

found in

Top 10k

29.36k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in Visual Studio Code community

44 packages

found in

Top 100

321 packages

found in

Top 1k

1549 packages

found in

Top 10k

16.36k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Open source communities depend on the work of thousands of software developers that volunteer their time to maintain software components. Software developers build up the reputation of their open source projects by developing in public. Modern source code repositories have many social features that allow software developers to handle bug reports, have discussions with their users, and convey reaching significant project milestones. It is uncommon to find open source projects that omit linking their component to a publicly accessible source code repository.

Prevalence in Visual Studio Code community

53 packages

found in

Top 100

442 packages

found in

Top 1k

3405 packages

found in

Top 10k

57.88k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to invoke commands that download additional content from a remote server. Attackers commonly abuse development extensions to fetch malicious payloads from public code repositories, file sharing websites, or their own infrastructure. Remotely hosted content is not immutable, allowing the attackers to change the type of malware they deploy at any time.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to execute commands that can collect sensitive system information. Attackers often abuse development extensions to run commands that collect identifiable system information such as hostnames, user names, folder structures, and other data points that could help them understand the environment in which their malicious code was loaded.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Prevalence in Visual Studio Code community

79 packages

found in

Top 100

622 packages

found in

Top 1k

4233 packages

found in

Top 10k

29.36k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider an alternative delivery mechanism for software packages.

Problem

Uniform Resource Locators (URLs) are structured addresses that point to locations and assets on the internet. URLs allow software developers to build complex applications that exchange data with servers that can be hosted in multiple geographical regions. URLs can commonly be found embedded in documentation, configuration files, source code and compiled binaries. Top-level domains (TLD) are a part of the Domain Name System (DNS), and are used to lookup an Internet Protocol (IP) address of a requested website. There are a few different types of top-level domains. Generic, sponsored and country-code TLDs are generally accessible to the public. Registrars that govern the assignment of domain names within the TLD may choose to sell specific domain names to an interested party. However, some registrars are known to have less strict rules for assigning domain names. Attackers often abuse gaps in governance and actively seek to register their malicious domains in such TLDs. This issue is raised for all domains registered within TLDs that harbor an excessive number of malicious sites. While the presence of suspicious TLDs does not imply malicious intent, all of its uses in a software package should be documented and approved.

Prevalence in Visual Studio Code community

44 packages

found in

Top 100

321 packages

found in

Top 1k

1549 packages

found in

Top 10k

16.36k packages

in community

Next steps

Investigate reported detections.

If the software should not include these network references, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider changing the top-level domain to avoid being flagged by security solutions.

Problem

Prevalence in Visual Studio Code community

53 packages

found in

Top 100

442 packages

found in

Top 1k

3405 packages

found in

Top 10k

57.88k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Monokai Pro

SAFE Assessment

Compliance

Security

Threats

TH16701Detected presence of development extensions that perform unusual actions.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16703Detected presence of development extensions with unusual networking functionality.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16704Detected presence of development extensions that can collect sensitive system information.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH30112Detected presence of software components without a declared source code repository.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

Did you know...

TH16701Detected presence of development extensions that perform unusual actions.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16703Detected presence of development extensions with unusual networking functionality.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16704Detected presence of development extensions that can collect sensitive system information.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17127Detected presence of files containing URLs that link to raw files on GitHub.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH17118Detected presence of files containing URLs that use suspicious top-level domains.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH30112Detected presence of software components without a declared source code repository.hunting

Problem

Prevalence in Visual Studio Code community

Next steps