Not quite. Their “malicious” extension only got a few hundred installs. Using the data gathered by that extension and via other means they were able to locate other actually malicious extensions. Those total in the millions of installations.
Through this process, they have found the following:
1,283 with known malicious code (229 million installs).
8,161 communicating with hardcoded IP addresses.
1,452 running unknown executables.
2,304 that are using another publisher's Github repo, indicating they are a copycat.
Ah it makes more sense that way, I didn’t read the title as if they were talking about all the extensions that they found summed together.
This does make it really clear that you should always check extensions when installing them, and not just install extensions with a low install base from an unknown author.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@beehaw.org
All things programming and coding related. Subcommunity of Technology.
Not quite. Their “malicious” extension only got a few hundred installs. Using the data gathered by that extension and via other means they were able to locate other actually malicious extensions. Those total in the millions of installations.
Ah it makes more sense that way, I didn’t read the title as if they were talking about all the extensions that they found summed together. This does make it really clear that you should always check extensions when installing them, and not just install extensions with a low install base from an unknown author.