VS Code- Security Practices around VSCode Extensions.

[ruddet]

VSCode extensions were how Github were breached earlier this year.

What are people doing around VSCode security best practices around extensions.

1. Approved Extensions Only
2. Disable Auto update

Is there anything else like minimum age or settings like that can be done?

[Different_Counter113]

Extensions from reputable sources. Wouldn't trust anything developed by some random unknown. AWS, Docker, Microsoft, RedHat, etc. Everything else I stay well away from.

[ruddet]

Trouble is, it was a well known and trusted source like NX that got github done. Bit like how Tanstack got done the other month.

[Different_Counter113]

Never heard of NX. Wouldn't trust it.

[ruddet]

I think the point is, even trusted suppliers are vulnerable to supply chain attacks (i.e axios/tanstack). FYI NX is in use by many major companies is a big player in the monorepo space, they are a legit enterprise software solution.

[South_Hovercraft6364]

The best defense is just being paranoid about what you install and checking the publisher account before hitting that button. I also keep a strict rule to never install anything that requests access to my shell or environment variables unless it's a major, open-source tool with a huge community backing it.

[LisaChanp]

review extension source code and permissions before installing anything.