Hacker News Reader

I found the malicious javascript (messages.js) file and put it in a Pastebin for anyone to analyze https://pastebin.com/yY1X0LiD

obviously its obfuscated by the guy originally

View on HN

This code is harmless. We may need a copy of the actual, shipped extension from vscode.

https://pastebin.com/T998ZstM

Here's a copy of it to download directly from MS...

I've seen literally nothing malicious in it so far.

!!! WARNING CLAIMED MALICIOUS PACKAGE !!!

https://marketplace.visualstudio.com/_apis/public/gallery/pu...

Isn't it about release-notes.js? There are quite a few files in there that are obfuscated. So far I haven't found anything super bad, it looks like a sanity.io client of some sorts, but there could be some stuff hidden in there as it's seems like quite a big JS bundle.

Reply on news.ycombinator.com