On April 21, 23pds, the Chief Information Security Officer of Slow Fog Technology, warned developers by forwarding a post from X platform user @mrdotparasyte, emphasizing the need to be extremely cautious when installing third-party plugins or packages.
Currently, there is a suspicious VSCode plugin named JuanFranBlanco.solidit-vscode, with an obvious spelling error of "solidit" in the plugin Identifier. The plugin has existed for two to three days, and it is currently unclear how many developers have inadvertently fallen victim. At present, supply chain attacks targeting developers are becoming increasingly prevalent, especially unaudited VSCode plugins and npm packages, which have become major disaster areas for such attacks.
