Show HN: Coder Guard – Protect Your IDE from Malicious Extensions
There is a growing problem with VSCode extensions:
- they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials
The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture
So I've been working on a way to help mitigate some of these risks
Right now, only an MVP of a "CLI" is available:
$ code --list-extensions --show-versions | curl --data-binary @- https://coderguard.io/scan
Which will list your installed extensions with some enriched information to vet their trustfulness
But much more detailed threat intel will be shown in the upcoming website and extension, including - Behavioural data gathered from running the extension on an instrumented sandbox environment - The ability to define policies to allow or block extension installs/updates, based on your specific risk appetite
For updates, sign up at https://coderguard.io or follow https://twitter.com/coderguard
The reason I'm posting this now is because I'd like to get some feedback in order to course-correct to make sure what I build actually solves people's problems
I'd be happy to read any comments, or answer any questions Very cool! I've built something similar, but for packages: https://github.com/ossillate-inc/packj Would love to talk. Looks like a great project; happy to talk Great! Let’s connect. Email in my profile. I don't know how adequate such vetting is. It puts the onus on the developers to look at the results and decide. Is there work being done to sandbox extensions? yeah there is! it's been in the works for a number of years, and they're talking about Q1 2023 but it will still leave all the vscode.* APIs open, so extensions can still do things like read any file in the filesystem, or run programs like they do today it's a start and an important step, but definitely not a cure-all