Post #344452
2026-01-22 09:12 UTC
Replies (20)
-
@mushu@social.troll.academy 2026-01-22 22:31
Thanks to @cxiao@infosec.exchange for highlighting these: https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/ https://opensourcemalware.com/blog/contagious-interview-vscode .. I do know that the version of tokenlinux.sh I retrieved also downloads node and executes something with it.
-
@morl99@hessen.social 2026-01-22 09:40
@mushu@social.troll.academy that is crazy... thanks for posting about it. Is it just me, or could the dialog be a little more specific about WHAT it automatically executes? And: why do I want my IDE to automatically execute stuff in a repo I open? What is the positive use case of such a feature? (I am an IntelliJ user, so that is a genuine question)
-
@codecat@meow.social 2026-01-22 09:41
@mushu@social.troll.academy I hate how many inexperienced or unsuspecting devs are gonna fall for this :(
-
@temptoetiam@eldritch.cafe 2026-01-22 10:05
@mushu@social.troll.academy sorry, non techie here: iiuc you detected foul play in the depository. Would it have infected your machine? Done something else?
-
@gkrnours@mastodon.gamedev.place 2026-01-22 10:20
@mushu@social.troll.academy oh yes, putting a lot of whitespace at the start of a command is a classic in roblox malware
-
@sol_hsa@mastodon.gamedev.place 2026-01-22 11:21
@mushu@social.troll.academy Chripes, that sounds like a major misfeature in vscode.
-
@Soblow@eldritch.cafe 2026-01-22 11:45
@mushu@social.troll.academy That's called dodging a bullet :dragn_sweats:
-
@Fischkind@chaos.social 2026-01-22 12:05
@mushu@social.troll.academy Maybe the real coding challenge was getting their repos deleted and now they'll offer you a job as their head of cyber security? 🤔
-
@freya@raru.re 2026-01-22 12:16
@mushu@social.troll.academy I hope you find less adversarial prospective employers!
-
@agitatra@berlin.social 2026-01-22 13:11
@mushu@social.troll.academy Did I got it wrong or was this a: "No Backup, No Mercy"-situation? I mean who gives more than strictly limited write access to strangers? BTW: I got my first it-job as a tester by crashing their system during the interview.
-
@ben@mastodon.lubar.me 2026-01-22 14:08
@mushu@social.troll.academy I wonder if anyone has made something that intentionally looks interesting to corporations that might be looking to steal code and ignore its license and added a .vscode/tasks.json that plays a really loud fart sound when executed
-
@zedaardv@mastodon.world 2026-01-22 14:43
@mushu@social.troll.academy Wow, reading these comments made me remember this job I had briefly (over 15 years ago) in Stockholm. I had a mac laptop, my work laptop was also a mac. And I was working with Postgres. I had the job for about 2 weeks before they let me go. I noticed at some point that they had installed a root-kit on my computer. (the were a sports betting company)
-
@uint8_t@chaos.social 2026-01-22 16:12
@mushu@social.troll.academy I wonder what the payload script contained
-
@nycki@bark.lgbt 2026-01-22 18:16
@mushu@social.troll.academy okay, why does she even HAVE that lever?
-
@un_bourguignon@piaille.fr 2026-01-22 18:27
@mushu@social.troll.academy Let's say that their security is bad as f*ck... And, if they can't do any restore, their resilience is even badder. @R1Rail@pouet.chapril.org
-
@xinit@mastodon.coffee 2026-01-23 16:39
@mushu@social.troll.academy "To me this is the visual language of Blockchain/NFT scams mixed with the butthole motifs that AI companies like so much." Beautifully written :D
-
@CyReVolt@mastodon.social 2026-01-24 14:58
@mushu@social.troll.academy thanks, I just noticed that the Electrolux logo is depicting a person wearing a thong, seen from behind and bending over, at an angle.
-
@icedquinn@blob.cat 2026-01-25 12:42
@mushu@social.troll.academy :hehe: this is passing a different test where the badges are black
-
@peritia@alovely.space 2026-05-04 15:06
@mushu@social.troll.academy this is insane!
-
@Catwoman69y2k@meow.social 2026-05-04 15:07
@mushu@social.troll.academy Yup. This kind of situation also makes a case against spec work.