personalcompute
Joined 15 years ago
Joined 15 years ago
Thanks for the nostalgia though. Amazing game.
ref: dang's comment @ https://news.ycombinator.com/item?id=45645793
https://d6f9e5179057.s3.us-west-2.amazonaws.com/Screenshot%2...
- That commit's date matches the date in the 404media article (July 13th)
- The commit message is totally unrelated to the code (highly suspicious)
- The code itself downloads additional code at runtime (highly highly suspicious)
I have not yet been unable to uncover the code it downloads though. It downloaded code that was hosted in the same repo, https://github.com/aws/aws-toolkit-vscode/, just on the "stability" branch. (downloads a file called "scripts/extensionNode.bk") The "stability" branch presumably was a branch created by the attacker, and has presumably since been deleted by Amazon.
The limitation stems from a design problem, details at https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1643706.