Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware
by lolinder on Monday February 10, 2025 @11:45PM
(#43009070)
Is this even related to npm? The extension was on the VS Code marketplace, I can't see any evidence that npm is involved at all besides that it's referenced in passing exactly once in the article:
> the need for caution when installing VS Code extensions, especially those obtained from public package registries like npm.
I'm not aware of any way to install a VS Code extension through NPM. The article honestly just reads like the author knew that Mend does a lot of business selling NPM dependency scanning and that they're therefore expected to stuff it as a keyword for SEO.
> the need for caution when installing VS Code extensions, especially those obtained from public package registries like npm.
I'm not aware of any way to install a VS Code extension through NPM. The article honestly just reads like the author knew that Mend does a lot of business selling NPM dependency scanning and that they're therefore expected to stuff it as a keyword for SEO.