Overview

Cybersecurity researchers have disclosed details of a now-patched bug impacting Open VSX's pre-publish scanning pipeline to cause the tool to allow a malicious Microsoft Visual Studio Code (VS Code) extension to pass the vetting process and go live in the registry. "The pipeline had a single boolean return value that meant both 'no scanners are configured' and 'all scanners failed to run,'" Koi

Organisations Involved

The following organisations are mentioned in relation to this incident: Bug Let Malicious, Code Extensions Bypass Pre, Microsoft, Microsoft Visual Studio Code, Publish Security Checks
Cybersecurity.