[Tangurena2]

I've heard about these attacks but never really had the time to understood what was happening. Some of our junior devs use VS Code, so now we have something to point them at.

[ashishb]

I have been targeted with this attack in the wild where '.vscode/tasks.json' had the auto-run code.

I smelled something fishy and never ran it though.

https://news.ycombinator.com/item?id=48127469

[ktm5j]

VS Code will helpfully warn you when you open a folder that has a git repository.. it asks if you trust the developers since opening the folder could result in bad things happening. So this might not be such a big deal for VS Code users.

[acdha]

I think that assumption is very dangerous: if your editor only prompts when you first open the project, it won’t help when that project is compromised later or if you checkout a merge request from someone untrustworthy/compromised and are mentally thinking “my project is safe” even though you’re a single gh/glab command away from that directory having anything an outside party wants.

[ceejayoz]

You know they're just gonna click yes, right?

That prompt is just there so they can say "your fault!"

[ktm5j]

Well, in that case it totally is their fault...

[MeetingsBrowser]

Only juniors are suing VSCode? What are others using?

[stronglikedan]

prob Cursor (also affected). at least that's preferred in my org

[vikramkr]

Point them at for what?