VSCode extensions with 9 million installs pulled over security risks
ID: 424b8bbc-dc62-5f96-b5fa-84f2b79ce05e
STIX ID: report--424b8bbc-dc62-5f96-b5fa-84f2b79ce05e
Feed Name: Bleeping Computer
Threat Score
**Microsoft removed two widely used VSCode extensions (Material Theme – Free and Material Theme Icons – Free) after security researchers discovered heavily obfuscated JavaScript in the extensions (notably in release-notes.js) and other red flags suggesting malicious behavior or a supply-chain compromise; the publisher was banned and Microsoft disabled/uninstalled the extensions from impacted VS Code instances while the developer blames a compromised/outdated dependency.**
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.