![](/static/66c60d9f/assets/icons/icon-96x96.png)
![](https://programming.dev/pictrs/image/8140dda6-9512-4297-ac17-d303638c90a6.png)
What’s wrong with Business Insider? Genuine question
What’s wrong with Business Insider? Genuine question
You declare it in the package.json as a category when publishing. It’s completely self-selected with no oversight, review, or enforced permissions.
I believe they’re referring to lower down in the article, where the researchers analyzed existing extensions on the marketplace:
After the successful experiment, the researchers decided to dive into the threat landscape of the VSCode Marketplace, using a custom tool they developed named ‘ExtensionTotal’ to find high-risk extensions, unpack them, and scrutinize suspicious code snippets.
Through this process, they have found the following:
- 1,283 with known malicious code (229 million installs).
- 8,161 communicating with hardcoded IP addresses.
- 1,452 running unknown executables.
- 2,304 that are using another publisher’s Github repo, indicating they are a copycat.
Yeah but it’s awful, and can only install UWP apps which are just plain bad
This is a fantastic write-up, thanks for sharing!