[MALWARE] Compromised VS Code extension

[IlyasMakari]

🚨 Security Alert: Malicious Version Detected on Open VSX

Hi @panoply,

My name is Ilyas Makari, and I’m a malware researcher at Aikido Security. I wanted to let you know that we’ve identified a compromised version of your VS Code extension Liquid published on Open VSX.

Specifically:

• sissel/shopify-liquid@4.0.1

This version appears to have been injected with malicious code that could trigger a payload when users install the extension.

We’ve already contacted Open VSX directly so they can take action on their side, but I wanted to make sure you’re aware as the maintainer. It would be a good idea to:

• Rotate your tokens and any associated credentials
• Enable MFA wherever possible
• Review recent account activity to ensure no other projects are affected
• Publish a new, clean version of the extension to help protect your users

We are still investigating the source of this attack, but we’ve seen a wave of similar attacks affecting multiple projects today.

If you’d like more technical details from our findings, I’d be happy to share them.

[panoply]

I find this very odd, explain?

[IlyasMakari]

I found that the latest version of the sissel/shopify-liquid extension on Open VSX contains a hidden malicious payload. Since you’re listed as the maintainer, I wanted to reach out to you directly about this. It looks like an attacker may have gotten access to your token somehow and used it to publish a new version with malicious code.

[opiateblush]

I just went here out of curiosity, but the struggle is real, according to this article. The payload is actually concealed using some kind of Unicode trick, but it's there and propagating using stolen credentials and by pushing the hidden payload again. I can't tell you where to find it, but your extension is listed under the compromised extensions in the referenced article. Maybe it would've been more convincing if @IlyasMakari shared some third-party references confirming his story.

[panoply]

Open VSX has invalidated the tokens. When I get more time I'll republish a version. Thanks for the heads up everyone, I'll keep this open an upstream once a newer version is available.

[logn133]

Does anyone have a sample of the malicious version for testing? I stupidly wiped before saving it for future investigation.