Material theme compromised?

[gegtor]

Material theme was deleted due to malicious activity by Microsoft

Continuing from this https://news.ycombinator.com/item?id=43178831

Can we get explanation as to what happened?
Should we take steps to mitigate potential compromise?

I did a quick analysis of the extensions code and found it connecting to authors CMS to get latest change log which is sketchy but not malicious

[callistoprime]

Posted 8 hours ago at the above link is this message from Microsoft below; reposting here to provide context missing from above.

Hi - Isidor here from the VS Code team.
A member of the community did a deep security analysis of the extension and found multiple red flags that indicate malicious intent and reported this to us. Our security researchers at Microsoft confirmed this claims and found additional suspicious code.
We banned the publisher from the VS Marketplace and removed all of their extensions and uninstalled from all VS Code instances that have this extension running. For clarity - the removal had nothing to do about copyright/licenses, only about potential malicious intent.
Expect an announcement here with more details soon https://github.com/microsoft/vsmarketplace/

[equinusocio]

Dear @gegtor nothing harmful was ever shipped within Material Theme.
We just had an outdated sanity.io dependency used since 2016 to show release notes from sanity headless CMS, that was the only issue they found.

That dependency has been there since 2016 and passed every check since then, now it looks compromised but NO ONE from Microsoft reached us to remove it. They just pulled down everything causing issues to millions of users, and causing a loop in vscode (yep, it's their fault)

SEE

They broke everything without ever reaching out to us for clarification. Removing the old dependency was a quick 30-second fix, but it seems that's just how Microsoft operates. We also ship an obfuscated index.js file that contains all the theme commands and logic. It's obfuscated because the extension is now closed-source; however, if you delete it, the extension will still function with plain JSON files.

We have now published a new theme that should have originally been called Material Theme Pro. This is a completely rewritten extension, offering more features and icons, and it has zero dependencies. Feel free to check it out to enjoy the same look and feel as the old Material Theme.

[std-microblock]

We also ship an obfuscated index.js file which includes all the theme commands and logic. Is obfuscated only because the extension is "now" closed-source, but if you delete it, the extension still works with plain json files.

LMAO that sounds even more suspicious. Why should the js ever exists and even obfuscated if most of user are not using it?

and do you mean that someone accuse you for distributing virus in your open-sourced code and your response is removing all the open-sourced code, even clearing commit history and after all these chaos claiming your plugin is completely safe?

I do not believe the discovery of malicious code in Material Theme at first, but now it seems reasonable just because you are having a guility conscience.

Disclaimer: I didn't checked any code yet, and I hope it's just a misunderstanding so that none of us would be in danger.

[riverar]

Theo states that he has "thoroughly audited the code base (nothing seemed malicious)" (source). Perhaps this is about an earlier commit tree, but it's unclear.

This raises questions about what led Microsoft to pull the extension and ban the user. It's also concerning that the original author claims Microsoft has not reached out to him directly.

Eager to hear more!

[equinusocio]

Theo states that he has "thoroughly audited the code base (nothing seemed malicious)" (source). Perhaps this is about an earlier commit tree, but it's unclear.

This raises questions about what led Microsoft to pull the extension and ban the user. It's also concerning that the original author claims Microsoft has not reached out to him directly.

Eager to hear more!

Spoiler: the person who posted on hackernews and member of the vscode team is a friend or a direct contact of Theo, probably. They banned us directly, even the extensions that were not using the souspicius old dependency (@sanity).

[ovflowd]

With all due respect, you created an open-source theme. I won't comment on the true effort and hours it takes to develop something like this, but it's only a few hundred lines of code that rarely need maintenance. After that, you transformed it into closed-source and made a scandal out of it.

In the meantime, thousands of people who genuinely contribute to open-source projects do so without drama and never ask for anything in return. If you believe the universe is conspiring against you, perhaps it's time to take a breather and get some fresh air.

[MrSubidubi]

@riverar Theo audited only the parts of the extension that were previously open-source. That is, before the author of the extension started rewriting the git history and made the actual extension closed-source. So, in fact, it is about the previous commit tree (which you can still find in plenty of the material theme forks).

Additionally, you can find some more information about the original theme and it's author in https://github.com/t3dotgg/vsc-material-but-i-wont-sue-you?tab=readme-ov-file#material-theme-but-i-wont-sue-you -TL;DR: He removed the Apache-License and then claimed it does not apply anymore (which it does), rewrote the Git-history multiple times (the last time today) and made multiple false claims based upon these rewrites.

Lastly, only today he moved the corresponding repository from the material-theme organization to the fanny-theme organization (which at the time of writing is already deleted, but you can still find plenty of the elements in the now moved-back repository and the so-called initial commit), moved back the repo to the old organization whilst disabling issues and discussions in its entirety and, lastly, created a third organization for his theme (see also his update to his readme: equinusocio/equinusocio@bed6c1a). All this whilst still being officially banned from the extension-store according to this Microsoft-comment.

I think all this should give a good perspective on who to trust here, how this all came together and played out.

[ovflowd]

That is an excellent write up, @MrSubidubi -- as someone that has also been doing open source for a long time; actions from people like the author of Material Theme severely hinder the trust people have with open source. These are unfortunate and selfish actions.

I don't know the author nor know their intents or if they are suffering of any conditions, hence Ill abstain from judging their character, but those actions are definitely not something we'd expect from open source maintainers.

[riverar]

Microsoft explicitly stated that the licensing dispute between the author and the community did not influence their decision. While the situation isn't ideal, I still believe we're missing critical information that justifies removing or banning the content/user.

@isidorn do you have a timeline for when Microsoft will share more information?

[archanyhm]

And of course @equinusocio re-uploaded the compromised extension for the second time after being banned from the Marketplace here: https://marketplace.visualstudio.com/publishers/vira-theme

If there's nothing wrong with the extension, surely you could wait until the dust has settled and some communication has been established with Microsoft explaining the supposed "suspicious dependency" and getting the ban lifted instead of circumventing the ban repeatedly.

[xetrics]

Where can I find the latest version of the extension pre-removal to do my own investigation into the source?

[gegtor]

equinusocio.vsc-material-theme-34.7.9.zip

I didn't find anything malicious aside from it phoning home to get changelog

[slickdomi]

I also have issues finding malicious things there despite all the red flags poking my eyes.

At first glance the ReleaseNotes.js is the same as non-obfuscated version from forks like https://github.com/wpconsulate/lynkdom-material-theme/blob/099d17e95689dde9d229bf8770a72d33f140e30f/build/ui/release-notes.js#L4728

Code referencing passwords and logins is from unshiftio/url-parse
Stuff from those ui directories appears to all go through browserify. If anyone else also analyses it and is a step further I'd appreciate pointing to interesting places. Theme with this much obfuscated code makes me uneasy.

[meowmix7]

Same @gegtor and @slickdomique, i de-obfuscated it from the original marketplace zip prior to this event, and ran some scans on it with multiple tools - yielded no results.
Other than improper usage of variables (injection potential) in path.join, which is silly.

(js files only in this zip)
Equinusocio.vsc-material-theme-34.7.9.zip

I'm not sure why it got flagged, but assume there was good reason.
Hope someone with more time and brain power can run through the code manually to identify whatever it is.
I'm very keen to learn what exactly it was doing that was malicious.

Original author mentioned that a dependency was to blame, https://www.npmjs.com/package/@sanity/client/v/2.1.0
I scanned that too and found nothing.