Asking for Equinusocio publisher restoration and relative extensions, censorship and shady discriminatory microsoft moves

[equinusocio]

Motivations

• As you stated here, there was nothing CONFIRMED to be harmful in our previous version of Material Theme (which has since been completely rewritten) at the time you published the official communication to the whole web (Reddit, HackerNews, Github). Despite this, you took down 6 extensions (but mentioned only Material Theme Icons), banned my entire account, and caused disruptions for millions of users—including introducing real problems (which you admitted responsibility for on HackerNews — image proof).

  • Your official statement:
    

• This decision destroyed 10 years of reputation and trust, all based on unfounded SUSPICIONS regarding obfuscated code—something you dislike, even though there was no evidence of harm. The only issue was an outdated sanity.io dependency within the obfuscated code, which could have been fixed in 30 seconds.

• You not only banned my entire account but also blocked my email, preventing me from contacting you in any way. There was no official channel provided to appeal or even discuss this matter. You never reached out for clarification (neither pre-ban nor post-ban) — unlike in other cases where you contacted fork authors after our ban — nor did you request that we deobfuscate the code or access the source code. I never received any notification about the ban—I only found out when a friend shared a Hacker News post with me, hours later.

• You acted differently depending on the interlocutor. As you stated here, you reached out to other "authors" AFTER the ban and both agreed that they had no malicious intent. Yet, when it came to me, you decided I had malicious intent (despite the code being identical, but you saw it obfuscated) — without ever reaching out to me, either before or after the ban, without any confirmation or proof.

Dark behavior and debatable actions

All forks created when our extension was open-source contained the exact same so-called "compromised" code—just without obfuscation. Yet, instead of taking them down, you reached out to them after our ban as stated by an individual called Theo(image proof), giving them time to update their versions while our extension was removed entirely.

For example, one of the many cloned extensions—created by this 🤡 Youtuber called Theo —contained the so-called "suspected code" right up until the ban. Yet, unlike Material Theme, they were given time to clean it up. After some minutes, they removed all the "suspected code".

Even more concerning, any user who installed version <35.0.0 of that fork – before the cleanup – and hasn't updated is still using that so-defined "compromised" version and dependency — yet the extension remains publicly available. Why the double standard?

Furthermore, there is NOTHING in the marketplace terms prohibiting closed-source or obfuscated code. If obfuscation was a concern, we could have easily removed it upon request.

Involvement with Other Fork Authors

Within just a few hours, you—as a VS Code team member, and by extension, Microsoft—were already promoting the very fork that you gave time to fix and remove the so-called "suspicious code. Code which is still PUBLISHED and used by users prior v35 (read above).

CLICK TO EXPAND

This raises serious concerns about bias and suggests either a deliberate attempt to undermine our credibility or, at the very least, a clear lack of professionalism from your team.

Persistent Unfair Treatment

We attempted to release a new version of our extension under a new name (the rename was planned) and a new publisher (vira-theme). Even though this version was completely rewritten from scratch, with no dependencies or runtime code related to your previous concerns, you repeatedly took it down without any public explanation or direct communication with us, and just based on random comments on Reddit. The only apparent reason for this action seems to be the presence of obfuscated code—implying that obfuscation alone is enough to classify an extension as malicious.

CLICK TO EXPAND

Additional discriminatory actions

@isidorn (PoemBusiness6939 on Reddit) as Microsoft's official voice, publicly accused that a random individual was impersonating me, solely based on the fact that they were criticizing Microsoft's actions.

CLICK TO EXPAND

This is not only false and baseless but also discriminatory.

This behavior sends a troubling message to the community: that decisions are being made based on unfounded suspicions, rather than proper investigation. This has nothing to do with security.

Community feedback and false positive

Additionally, there are clear signs of a false positive report from your community, yet no effort was made to verify this before taking irreversible action. (CLICK TO EXPAND)

From this repo

Requests

If your review of MY SOURCE CODE confirms that there is nothing malicious, I formally request the full restoration of our publisher accounts (Equinusocio and vira-theme), all related extensions, and user access to the theme. Additionally, all installations and insights should be reinstated.

I also request a public apology from the team (and @isidorn the person who started this panic-oriented campaign) and the removal of all misleading, panic-inducing information shared on Hacker News and other official channels even before real investigation or CONFIRMED malicious code, and before any official statement. Even if malicious intent were proven, there was absolutely no justification for giving other forks time to remove the violated dependencies while immediately taking down Material Theme based on false claims—without any prior investigation.

Conclusion

As for the VS Code team — and by extension, @microsoftopensource — the entire team, and particularly @isidorn, publicly accused me of criminal activity by spreading false and unverified information.

This is defamatory and illegal under multiple legal frameworks, as it constitutes false accusation, reputational damage, and libel. Publicly accusing someone of criminal activities — such as intentionally distributing viruses or malicious code — without evidence is a serious offense. This is especially true when the accusation comes from a major corporation with significant influence, as it can cause severe reputational and professional harm. Such actions can have real-world consequences, including professional and personal harm.

I will also reach out to Microsoft to resolve this matter and pursue the appropriate action.

---

March 2, 2025 (4 days after the "malicious intent" statement): They still haven’t reached out to me.

---

Yet another example of the VS Code team's unprofessionalism and their questionable involvement with this individual named Theo. This confirms what was stated earlier: they removed my other account with a completely new extension (Vira Theme), without even bothering to review it. This goes far beyond "security" concerns.

---

Willing to collaborate

I am willing to grant vscode team access to review, for real this time, the source code.
I've opened the code so everyone, and not only the vscode team or controversial startups can see and perform their analysis. I am also open to discussing the obfuscated code and the reasoning behind this decision to reach a fair resolution and provide you the new .vsix file to restore on the marketplace in place of the old "harmful" version of the extension.

Source code of release-notes.ts (the subject file)

Deobfuscated compiled release-notes.js (the subject file)

Obfuscated release-notes.ts (the subject file)

It takes just 30 seconds to see that there is no direct correlation between the build code and the source code. There is a potential issue that lies in how code is compiled that pulls in the @sanity.io/client dependency inside the output build, with or without obfuscation.

What kind of "person with malicious intent" openly shows their face and actively collaborates?

---

March 3, 2025 (4 days after the "malicious intent" statement): They still haven’t reached out to me).

I bet no one—myself included—initially realized that the "suspicious" extension appears to be only Material Theme Icons, meaning some of the previous statements are partially inaccurate.

That said, as part of my supposed "malicious intent," I have also opened the source code of that extension so that anyone can analyze it directly, rather than relying on speculation based on obfuscated code. I don't care about this anymore, my conscience is clear, who knows if this also applies to others.

[vilnytskyi]

For anyone wanting to reveal a real 🤡 here, check "This VS Code theme is threatening people?" video on YouTube. History doesn't lie, dude. And even assuming it was a false positive report that caused this, I'm personally still happy this happened and hopefully, you and anyone else like you will learn their lesson from it.

EDIT: OP has removed his mocking reference since I posted this, as he usually behaves. Thankfully, there's the "Edits" dropdown in the post's header, which allows you to check the post's history.

[yssrku]

Put the author's previous bad interactions with the community aside, there's nothing wrong with him choosing to close source and distribute obfuscated scripts instead. People do this all the time.

While Microsoft has the right to ban someone for any reason, calling it malware is a very serious accusation.
Supply chain attacks are real, and companies put a lot of effort into responding to each incident.
I hope MS can provide more evidence if there was indeed malicious code or behavior.

[t3dotgg]

The "cloned" (forked) extension is different in a few distinct ways:

1. It was never shipping obfuscated code
2. All exec calls, web views, and client-side JS was removed
3. The maintainer isn't consistently engaging in malicious behavior and attempts to rewrite history

You've edited this post over 16 times in the past 12 hours @equinusocio. You need to go offline man, you're not doing well.

[tuananh]

open-source vscode ext & theme should be signed & provide provenance how they were built. this would put my nerve at ease.

[andrewmd5]

The "cloned" (forked) extension is different in a few distinct ways:

1. It was never shipping obfuscated code
2. All exec calls, web views, and client-side JS was removed
3. The maintainer isn't consistently engaging in malicious behavior and attempts to rewrite history

You've edited this post over 16 times in the past 12 hours @equinusocio. You need to go offline man, you're not doing well.

Theo, you should refrain from participating in this matter. You have a history of sending your community into a frenzy and exacerbating situations with superficial information and hasty conclusions. For instance, you posted an entire blog labeling this individual as dangerous and claiming that you were doing so for SEO purposes. It’s evident that you shouldn’t be involved in this matter at all. You cannot insert yourself as the hero in this story for clout; the guy is obviously spiraling. Empathy goes a long way.

It’s clear that the VSCode team made a significant choice here, and throughout the process, they have provided no substantial information or analysis. In contrast, when Apple decided to remotely uninstall Zoom, they released a detailed report of their findings. The VSCode team has offered nothing of substance. Part of running a platform is separating personal feelings of the developer from the objective truth of the matter. All third-party analysis conducted thus far indicates that this was a false positive.

The issue is simple: publish your findings to certify the reason for the ban (and the criteria you use to determine when to remotely modify users VSCode instances), or unban the developer.

[orionsolidified]

Theo, you should refrain from participating in this matter.

Why should Theo refrain when the issue author had accused him of ridiculous claims? If the issue author didn't bring Theo up to the issue, then Theo could have refrained. As a third party to this case (and as a lawyer), Theo has every right to say his piece when he is mentioned. Or the issue author should retract of any mention of Theo.

The issue is still under investigation.

[andrewmd5]

Theo, you should refrain from participating in this matter.

Why should Theo refrain when the issue author had accused him of ridiculous claims? If the issue author didn't bring Theo up to the issue, then Theo could have refrained. As a third party to this case (and as a lawyer), Theo has every right to say his piece when he is mentioned. Or the issue author should retract of any mention of Theo.

The issue is still under investigation.

as a lawyer

Then you should be able to recognize tortious interference. Despite Theo learning more information on a live stream that this most-likely isn't malware, he doubled down and called for the end of the extension authors career based solely on his personal dislike of him from past interactions, going as far as posting a blog with these unproven claims and boosting that blog so it comes up when you Google the author. This is an attempt to canonize something that as you stated, is still under investigation. Any interactions between these parties only serves to exacerbate the situation further.

I think the author should remain silent as well, if this turns out to be based on false-positive reports without proper investigation then he can make a pretty strong claim of defamation against a few different parties to this issue. All he has to do right now is nothing.

In the meantime, I would love to know why there still hasn't been any material disclosure. Millions of VSCode instances were remotely modified, was there a branch / threat or not?

[MarkoDaro123]

The fact that this extension got pulled, and the developer got banned, while containing no malicious code is wild to me. I hope we get an update from microsoft.

[scplay]

I support the VS Code team's action due to potential risks and user safety concerns.

He has engaged in several improper actions that should indeed be condemned, such as modifying the Material Theme License(trying to hide the fact that the project is opensource) and force pushing commits to overwrite other contributors' work.

But now that he has made the source code public, I think the VSCode team should provide a convincing reason for continuing to block his account; otherwise, it appears somewhat unfair.

[Obyvante]

First, we must understand the perspective of the Microsoft team. They can (and should) suspect an extension and remove it from all devices. The key point is the word “suspect.” If they detect many red flags and believe it is sufficiently suspicious, they should take it down immediately without notifying the extension’s developer or owner.

The reason they shouldn’t contact the developer before taking down the extension is that they do not know the content of the obfuscated code. Of course, they could deobfuscate it and review the main code, but that is suspicious enough to warrant its removal. Imagine if this were a potential threat and the Microsoft team decided to contact the developer or owner, even though there are already enough red flags to justify taking it down. It is impossible to know if they would execute something using the suspicious code. The Microsoft team should also consider the actions of the developers and owners.

Another point is that we should not make definitive accusations without certainty. Even if you dislike—or even hate—the developer, you should not make random accusations without proof that the code is indeed malicious (I'm not referring to mere suspicion, but to cases where the code is directly attacking, damaging, or stealing from the user).

In my opinion, this decision is spot on, and the Microsoft team should investigate the extension while it is unavailable to the public.

Regarding the actions of Theo and the Microsoft team, they did not claim that the developer’s purpose was to ship a malicious extension to hack or attack users. Instead, they shared their concerns, potential risks, and what happened overall.

If I miss any point or share misinformation without being aware of the most recent events (even though I have read everything and have been watching closely from the start), please let me know, as I do not want to accuse or spread false information that could damage either party or any individuals.

[andrewmd5]

First, we must understand the perspective of the Microsoft team. They can (and should) suspect an extension and remove it from all devices. The key point is the word “suspect.” If they detect many red flags and believe it is sufficiently suspicious, they should take it down immediately without notifying the extension’s developer or owner.

The reason they shouldn’t contact the developer before taking down the extension is that they do not know the content of the obfuscated code. Of course, they could deobfuscate it and review the main code, but that is suspicious enough to warrant its removal. Imagine if this were a potential threat and the Microsoft team decided to contact the developer or owner, even though there are already enough red flags to justify taking it down. It is impossible to know if they would execute something using the suspicious code. The Microsoft team should also consider the actions of the developers and owners.

Another point is that we should not make definitive accusations without certainty. Even if you dislike—or even hate—the developer, you should not make random accusations without proof that the code is indeed malicious (I'm not referring to mere suspicion, but to cases where the code is directly attacking, damaging, or stealing from the user).

In my opinion, this decision is spot on, and the Microsoft team should investigate the extension while it is unavailable to the public.

Regarding the actions of Theo and the Microsoft team, they did not claim that the developer’s purpose was to ship a malicious extension to hack or attack users. Instead, they shared their concerns, potential risks, and what happened overall.

If I miss any point or share misinformation without being aware of the most recent events (even though I have read everything and have been watching closely from the start), please let me know, as I do not want to accuse or spread false information that could damage either party or any individuals.

Theo did make public statements saying it was malware on more than one occasion. I’m sure others can point to other instances, as well as gloating that the developers career is “over.”

The team acted in a way that has irrevocable consequences; you can’t reinstall the extension for users or repair the developers reputation - there should have been a proper confirmation of a threat and disclosure. None of that happened, and here we are looking for transparency. None of this should be handled based on vibes.

Edit:

And also saying he won’t correct those statements until he receives an apology.

[Naymmmm]

Nuked a perfectly open source theme... sure buddy, sure.

[paulocoghi]

The "cloned" (forked) extension is different in a few distinct ways:

1. It was never shipping obfuscated code
2. All exec calls, web views, and client-side JS was removed
3. The maintainer isn't consistently engaging in malicious behavior and attempts to rewrite history

You've edited this post over 16 times in the past 12 hours @equinusocio. You need to go offline man, you're not doing well.

I really can't understand why someone would submit obfuscated code, even worse with exec calls (presuming what @t3dotgg said to be true). 🤦

Put the author's previous bad interactions with the community aside, there's nothing wrong with him choosing to close source and distribute obfuscated scripts instead. People do this all the time.

Just because people do bad things all the time doesn't means others can follow the example without consequences.

And asking to "put the author's previous bad interactions with the community aside" seems not a reasonable thing to ask. Bad interactions also talk.