Spectra Assure

failIncident: Removal

Scanned:

Dark+ Material

Artifact:

latest

removed

Top 1k

The default Dark+ theme, using Material's color palette

License: Permissive (MIT)

Published:

Publisher: vangware

Visit GitHub

See on Visual Studio Code

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

4 dangerous develop extensions

Malware

No evidence of malware inclusion

INCIDENTS FOR THIS VERSION:

removal

Reported By: Community

Overview issues14 vulnerabilities0 malware0 behaviors228 dependencies0 contributors1 versions132

Popularity

437.8k

Total Installs

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. However, extensions are commonly abused by threat actors to execute arbitrary commands within the development environment. It was detected that the extension code could execute commands that are not typically used by development tools. Such unusual commands resemble common threat actor tactics and are usually obscured by layers of cryptography, code obfuscation, anti-analysis features, and other detection evasion techniques.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to invoke commands that download additional content from a remote server. Attackers commonly abuse development extensions to fetch malicious payloads from public code repositories, file sharing websites, or their own infrastructure. Remotely hosted content is not immutable, allowing the attackers to change the type of malware they deploy at any time.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to execute commands that can collect sensitive system information. Attackers often abuse development extensions to run commands that collect identifiable system information such as hostnames, user names, folder structures, and other data points that could help them understand the environment in which their malicious code was loaded.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to execute commands that can collect sensitive system files. Attackers often abuse development extensions to run commands that collect authentication details such as tokens and credentials, private keys, environment files, and other secrets that could help them gain unauthorized access to the system on which their malicious code was loaded.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Software components are typically distributed in standardized packaging formats. Software packages are built from instructions written within package manifests that act as blueprints for package assembly. A package manifest declares the most important software properties, such as the package name, its authors and license, external dependencies, and various actions that may occur during the package lifecycle. Package managers are specialized tools used by developers to manage software components. Package managers read these manifests to deploy software components along with their dependencies. The premise of the package management system is that software components are isolated from each other, and that they rely on the package manager to provide their dependencies. However, it was detected that a software component includes code capable of accessing or modifying directories that are maintained exclusively by package managers. This is unusual as it resembles tactics used by threat actors that tamper with installed software components and inject malicious code into trusted execution paths.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1554 - Compromise Host Software Binary.

Consider rewriting the flagged code without using the marked behaviors.

Top behaviors

See all behaviors

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

53 packages

found in

Top 100

331 packages

found in

Top 1k

1160 packages

found in

Top 10k

5.29k packages

in community

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

67 packages

found in

Top 100

547 packages

found in

Top 1k

2891 packages

found in

Top 10k

14.99k packages

in community

Prevalence in Visual Studio Code community

No behavior prevalence information at this time

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

45 packages

found in

Top 100

315 packages

found in

Top 1k

1576 packages

found in

Top 10k

7.59k packages

in community

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

84 packages

found in

Top 100

679 packages

found in

Top 1k

4393 packages

found in

Top 10k

30.42k packages

in community

Top vulnerabilities

No vulnerabilities found.

FAQ for Dark+ Material

What is Dark+ Material?

The default Dark+ theme, using Material's color palette. For more information about this package, visit its homepage.

Is Dark+ Material malicious or is it safe to use?

The VS Code package Dark+ Material has been removed from registry. It was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. Malware or tampering has been detected, making it unsafe to use. The package contains risks, and the analysis results should be reviewed before it is used. Visit the Issues and Behaviors sections of the analysis for more details. All versions of the Dark+ Material package were removed.

Is Dark+ Material popular?

The VS Code package Dark+ Material ranks among the top 1000 projects in this community. It has 438K recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure Dark+ Material once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how Dark+ Material behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a Dark+ Material version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

Popularity

437.8k

Total Installs

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to invoke commands that download additional content from a remote server. Attackers commonly abuse development extensions to fetch malicious payloads from public code repositories, file sharing websites, or their own infrastructure. Remotely hosted content is not immutable, allowing the attackers to change the type of malware they deploy at any time.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to execute commands that can collect sensitive system information. Attackers often abuse development extensions to run commands that collect identifiable system information such as hostnames, user names, folder structures, and other data points that could help them understand the environment in which their malicious code was loaded.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Development extensions are commonly used by software developers to extend the functionality of integrated development environments, code editors, and other developer tools. Extensions are typically distributed through public marketplaces as packages that bundle the extension code with supporting resources. Development extension code implements behaviors that integrate it with the host application. This integration allows extensions to register commands, react to editor events, or provide programming language support. Extension code is loaded and executed automatically by the host application during events such as editor startup, file opening, or user interaction. These events are used by extension developers to set up the environment for nominal extension use, or to respond to activity within the host application. It is unusual for certain types of development extensions to execute commands that can collect sensitive system files. Attackers often abuse development extensions to run commands that collect authentication details such as tokens and credentials, private keys, environment files, and other secrets that could help them gain unauthorized access to the system on which their malicious code was loaded.

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections.

Consult Mitre ATT&CK documentation: T1176.002 - Software Extensions: IDE Extensions.

If the development extension intent does not relate to the reported behavior, investigate your development environment for software supply chain compromise.

You should stop using the development extension until the investigation is completed, or until the issue is risk accepted.

Consider replacing the development extension with an alternative.

Problem

Prevalence in Visual Studio Code community

No prevalence information at this time

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1554 - Compromise Host Software Binary.

Consider rewriting the flagged code without using the marked behaviors.

Top behaviors

See all behaviors

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

53 packages

found in

Top 100

331 packages

found in

Top 1k

1160 packages

found in

Top 10k

5.29k packages

in community

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

67 packages

found in

Top 100

547 packages

found in

Top 1k

2891 packages

found in

Top 10k

14.99k packages

in community

Prevalence in Visual Studio Code community

No behavior prevalence information at this time

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

45 packages

found in

Top 100

315 packages

found in

Top 1k

1576 packages

found in

Top 10k

7.59k packages

in community

Prevalence in Visual Studio Code community

Behavior often found in this community (Common)

84 packages

found in

Top 100

679 packages

found in

Top 1k

4393 packages

found in

Top 10k

30.42k packages

in community

Top vulnerabilities

No vulnerabilities found.

Dark+ Material

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been removedLatest version with removal incident detected: over 2 years agoVersion: 3.2.1

INCIDENTS FOR THIS VERSION:

Popularity

Top issues

TH16701Detected presence of development extensions that perform unusual actions.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16703Detected presence of development extensions with unusual networking functionality.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16704Detected presence of development extensions that can collect sensitive system information.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16705Detected presence of development extensions that can access sensitive system files.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16129Detected presence of software components that can tamper with other installed software.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

Top behaviors

Tampers with system environment variables.settings

Prevalence in Visual Studio Code community

Modifies file/directory permissions.permissions

Prevalence in Visual Studio Code community

Writes to directories managed by package managers.file

Prevalence in Visual Studio Code community

Changes file ownership.file

Prevalence in Visual Studio Code community

Might contain potentially obfuscated code or data.anomaly

Prevalence in Visual Studio Code community

Top vulnerabilities

FAQ for Dark+ Material

What is Dark+ Material?

Is Dark+ Material malicious or is it safe to use?

Is Dark+ Material popular?

How do I secure Dark+ Material once it is in my app?

Did you know...

Popularity

Top issues

TH16701Detected presence of development extensions that perform unusual actions.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16703Detected presence of development extensions with unusual networking functionality.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16704Detected presence of development extensions that can collect sensitive system information.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16705Detected presence of development extensions that can access sensitive system files.Causes risk: dangerous develop extensionshunting

Problem

Prevalence in Visual Studio Code community

Next steps

TH16129Detected presence of software components that can tamper with other installed software.hunting

Problem

Prevalence in Visual Studio Code community

Next steps

Top behaviors

Tampers with system environment variables.settings

Prevalence in Visual Studio Code community

Modifies file/directory permissions.permissions

Prevalence in Visual Studio Code community

Writes to directories managed by package managers.file

Prevalence in Visual Studio Code community

Changes file ownership.file

Prevalence in Visual Studio Code community

Might contain potentially obfuscated code or data.anomaly

Prevalence in Visual Studio Code community