Infected by JS.Siggen5.44590

[alersrt]

Version 1.116.0-1 in AUR is infected with JS.Siggen5.44590.

[winterunciorn-blip]

I have the same problem. It's preventing the update from installing because the JS file is blocked by antivirus. I can't manage it because of policies. Fix it please.

[aol-nnov]

I can confirm, Version: 1.116.0 Commit: 560a9db contains infected es5-ext module.

(I've extracted it from app bundle and sent to online scanner)

[aol-nnov]

While it looks harmless at first sight, it is a registered threat in major antivirus scanners and might make troubles to end users.

It might be introduced by 62a503d (package.json) as @microsoft/dev-tunnels-connections@1.3.41 depends on es5-ext@0.10.64

├─┬ @microsoft/dev-tunnels-connections@1.3.41
│ ├─┬ es5-ext@0.10.64
│ │ ├─┬ es6-iterator@2.0.3
│ │ │ ├─┬ d@1.0.1
│ │ │ │ └── es5-ext@0.10.64 deduped
│ │ │ └── es5-ext@0.10.64 deduped
│ │ └─┬ esniff@2.0.1
│ │   ├── es5-ext@0.10.64 deduped
│ │   └─┬ event-emitter@0.3.5
│ │     └── es5-ext@0.10.64 deduped
│ └─┬ websocket@1.0.35
│   └── es5-ext@0.10.64 deduped

[alersrt]

@aol-nnov Its unexpected behavior what can lead to bigger threats. There should be zero-patience politics against such kinds of things.

[aol-nnov]

@alersrt you might better file an upstream bug and link it here rather than debating on the threat size...

Let's make it clear: it's not a supply chain attack or anything. It' a well-known, ahem, "feature" of es5-ext. And it should be addressed upstream first-hand.

[alersrt]

@aol-nnov We're exactly here already. And again — it's considered as malicious because it has undocumented behavior. Such kind of things are unacceptable for production use, that's the main reason why this issue was opened at all.

[zartdinov]

Similar issue was closed #160012.

It doesn't seem like anything special for now, but it's also not a serious approach for a company of this level.

The risk that data on my computer could be destroyed or stolen after such antics after some autoupdate is funny.

[aol-nnov]

While multiple developers are dumping es5-ext or pinning to older versions, others create maintainable forks with no b-shit attached: https://www.npmjs.com/package/@unes/es5-ext

[alersrt]

@aol-nnov Fork is okay, but it's using should be managed on the Microsoft side.