Hello and welcome to the Friday, June 27, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, and this episode brought you by the Sands.edu graduate certificate program in Purple Team Operations is recorded in Stockholm, Germany.

Well, we got a big supply chain security story to start out with today.

This story was broken by Koi Security.

The problem here is the use of Visual Studio Code clones.

Now, Visual Studio Code, of course, Microsoft product. It comes with its own

extension store. And this extension store has had issues in the past. We talked about this

here in this podcast a couple times. But there are a couple clones, like, for example, cursor,

the editor used a lot with AI projects.

And the cursor, because it's not a Microsoft product,

but it is a clone of Visual Studio code,

cannot use the official Microsoft extension store.

In order to fix this, well, we have OpenBSX. OpenVsX is an extension store for all these different Visual Studio code clones that cannot use the official Microsoft store.

The problem with OpenVSX was that they had two different ways how an developer could update an extension.

One is where basically just upload the extension to them, but then there's another

a little bit more convenient way of doing it where they're auto-updated. And you basically

just add your extension to the list of extensions for OpenVSX to auto-update,

and then whenever it recognizes there is a new version, it will download your extensions,

and then it will run NPM install.

And that's where the problem happens.

With NPM install, the GitHub action that OpenBSX uses to update the extensions.

Well, it's actually executing code provided by the developer of the extension.

...