PlatformIO IDE extension has been removed with over 4,500,000 unique installs

[ivankravets]

• https://marketplace.visualstudio.com/items?itemName=platformio.platformio-ide
• https://platformio.org/platformio-ide

[mariaghiondea]

These extensions and a few others were removed from the Visual Studio Marketplace as versions were flagged as malicious. We will be working with owners to bring them back.

[ivankravets]

Please restore our extension and keep all history with versions and stats. We WILL NOT upload a new version until you revert back our extension. See https://embedded-development-in-vscode.github.io/overview/

were flagged as malicious

Please provide any arguments that the PlatformIO IDE extension had any "malicious" issues. That was an internal fault by Microsoft engineers who wrote the "wrong" auto-remove script that deleted all popular extensions. Please restore our extension and keep all our reviews and downloads.

[mariaghiondea]

Several versions of the extensions contained a package that is known bitcoin mining malware.

Unfortunately, we can't restore extensions. That was a miss on our part. And I do apologize for the inconvenience!

If you can please work with us and upload a new version, we can restore stats, like install counts.

[RioTrax]

Microsoft and PlatformIDE users asks to bring the extension back! that's abusive to remove it like that!
fully supportive of @ivankravets request

[ivankravets]

Will you be able to restore all the information, including reviews? One day, a new engineer decided to delete everything we had been working on since 2016. How is that possible without any backup? Without any notice?

Please check this page https://embedded-development-in-vscode.github.io/overview/

[t1m0thyj]

Unfortunately, we can't restore extensions.

This is unacceptable. We rely on the VS Code Marketplace as enterprise-grade infrastructure. The admins of our VSMarketplace project received no notification about our extension being unpublished.

If an extension is flagged as malicious, this does not justify a sudden and irreversible deletion of it. The extension should be made private and the owners should be contacted via email.

Restoring our extension (Zowe Explorer) will be a tedious process as we have many old versions that are important to keep around, as some of our customers need to stay pinned to an older version.

[ivankravets]

@mariaghiondea, do you have any updates? Based on the public stats (https://embedded-development-in-vscode.github.io/overview/), PlatformIO IDE is receiving over 3,000 new installs per day. This issue is affecting many users, and they have started raising concerns on various social platforms, including Twitter and Reddit.

As @t1m0thyj pointed out, it seems unreasonable for Microsoft to remove such a popular extension without marking it as "hidden", "private" or "requiring attention". Our history and reputation are the top reasons why companies choose PlatformIO for their product development.

Please help 🙏

[zFernand0]

Hey @mariaghiondea,

How will you be reaching out to the various affected owners?

Shall we open individual issues? Or will emails to the [email protected] be sufficient?

FWIW, you should've received an email earlier this morning about the Zowe.vscode-extension-for-zowe extension

[bignimbus]

Several versions of the extensions contained a package that is known bitcoin mining malware.

What package is that?

[mariaghiondea]

We are working on a solution to restore the extensions. I will update this thread as we make progress.

[mariaghiondea]

Several versions of the extensions contained a package that is known bitcoin mining malware.

What package is that?

flatmap-stream npm package

[mariaghiondea]

Hey @mariaghiondea,

How will you be reaching out to the various affected owners?

Shall we open individual issues? Or will emails to the [email protected] be sufficient?

FWIW, you should've received an email earlier this morning about the Zowe.vscode-extension-for-zowe extension

We are reaching out to all owners. We are working on a solution to restore packages and stats.

[mariaghiondea]

@mariaghiondea, do you have any updates? Based on the public stats (https://embedded-development-in-vscode.github.io/overview/), PlatformIO IDE is receiving over 3,000 new installs per day. This issue is affecting many users, and they have started raising concerns on various social platforms, including Twitter and Reddit.

As @t1m0thyj pointed out, it seems unreasonable for Microsoft to remove such a popular extension without marking it as "hidden", "private" or "requiring attention". Our history and reputation are the top reasons why companies choose PlatformIO for their product development.

Please help 🙏

Agreed. We are making process improvements, to prevent this.

[t1m0thyj]

Several versions of the extensions contained a package that is known bitcoin mining malware.

What package is that?

flatmap-stream npm package

@mariaghiondea There must be other packages that were also flagged. The flatmap-stream npm package is not included anywhere in our project's dependency tree.

Edit: Seems that it used to be - in an old version from 2018: https://code.visualstudio.com/blogs/2018/11/26/event-stream

[mariaghiondea]

Platformio ide extension was reuploaded successfully: Extention: PlatformIO IDE - Visual Studio Marketplace

We will be updating stats shortly.

[logikdev]

@mariaghiondea The version for Linux 64 bit does not seem to be available. Will it be available soon?

[ivankravets]

@mariaghiondea , thanks for the updates! Will we help if re-submit the latest version with the host-dependent extensions (windows, Linux, Mac)?

[mefenlon]

I see it listed now, but getting this message

The 'PlatformIO IDE' extension is not available in Visual Studio Code for Mac Silicon.

[dosipod]

I see it also in codespaces but we get the error
The 'platformio.platformio-ide' extension is not available in Visual Studio Code for Linux 64 bit.

For another project we did the build the VSIX Package workaround but this is becoming an issue to spend a lot of time on the tool
rather then the project

[drunkscientist]

Platformio ide extension was reuploaded successfully: Extention: PlatformIO IDE - Visual Studio Marketplace

ok but i only see win64 supported. im kinda expecting a list. like:

took me way too long to figure out it wasnt me or my machine for once. would like to see the actual stuff back before worrying about metrics/stats

[mariaghiondea]

@mariaghiondea , thanks for the updates! Will we help if re-submit the latest version with the host-dependent extensions (windows, Linux, Mac)?

@ivankravets That will help immensely. Thank you so much for the help. And apologies for the inconvenience this has caused!

[sunpazed]

Likewise, no longer available for Mac Silicon. Frustrating.

[arastaskiran]

@mariaghiondea The version for Linux 64 bit does not seem to be available. Will it be available soon?

First of all, I would like to express how sorry I am for this incident. Today, I installed a new operating system and, as my first task, I tried to install PlatformIO, only to encounter this unfortunate news. We are eagerly waiting for the Linux amd64 support.

[ivankravets]

Hi @mariaghiondea,

We have thoroughly reviewed all nested NPM dependencies in the PlatformIO IDE extension. The extension does not depend on flatmap-stream, as confirmed in our package.json file. Additionally, we examined all nested dependencies and found no trace of flatmap-stream. You can independently verify this by running:

yarn list | grep "flatmap-stream"

If this issue is related to an older version from 2017-2018 due to the SemVer specification - where packages can rely on others via ^ or ~ - it’s possible that bad actors introduced a malicious "patch" version. Unfortunately, this is outside our control, though we always strive to keep our code base updated with the latest package versions. Even if some outdated version was impacted years ago, it raises the question: why was the entire extension removed?

Could you clarify the real reason behind deleting the PlatformIO IDE extension? Who made this decision? We believe transparency is essential to prevent similar incidents from happening in the future.

For now, we have published a new "technical" version (3.3.4), which includes packages for all platforms. We are also waiting for the reviews to restore the extension.

Thanks 🙏

[mariaghiondea]

I've been posting this across our different threads, so I wanted to share it here too:

For a bit of context, my team (the Visual Studio Marketplace team) is doing a focused effort on security and looking for ways to become more proactive in the space, as well as react to existing threats. As part of that, we were scanning all extensions and discovered that 45 of them had older versions that needed to be removed. They were flagged as malicious because they contained the flatmap-stream npm package that is known bitcoin mining malware.

Due to miscommunication, this resulted in the removal of several extensions where only the older versions were flagged, and only those should have been removed. This affected your extension.

We realized it a few hours after and started taking action. This included communication to all package owners affected and trying to recover the extensions.
At this time, latest version for these extensions is recovered and install counts restored. We will work to bring back other stats too, during business hours next week.

This caused a lot of disruption for the community, and for the team.
We greatly appreciate everyone's patience and help!

We are currently doing an RCA. We are already implementing some of the repair items, to:

• Increase transparency by communicating such impactful actions to the publishers and community before we take them and after we take them
• Prevent the wrong action to be taken and look for gradual progression towards irreversible action
• Improve the ability to recover data (more, faster, easier)

Please let me know your feedback. We'd love to use it in our RCA!

[bit4man]

Due to miscommunication, this resulted in the removal of several extensions where only the older versions were flagged, and only those should have been removed. This affected your extension.

While we all make mistakes and I think all of us have some big one behind us, this statement combined with the "we'll just delete it" is scary. No enterprise level IT should function this way. You make it sound like the SECOPS that removed the accounting general ledger module with no backups, because you found something you didn't like.

I support a proactive approach but the implemented approach lacked accountability and enterprise concepts. The fact that it's not just this popular extension that's hit makes this really sad. Going forward I hope the group at MS will change policies on how to interact with 3rd party extensions. At the very very least have a system that doesn't remove content or make it unrestorable. That final removal action seems to scream "need approval, need thought". Please ensure backups exist and a method for your team to mark extensions as being available or not, so you can take immediate action without having to remove content.

[umit-senn]

I've been posting this across our different threads, so I wanted to share it here too:

For a bit of context, my team (the Visual Studio Marketplace team) is doing a focused effort on security and looking for ways to become more proactive in the space, as well as react to existing threats. As part of that, we were scanning all extensions and discovered that 45 of them had older versions that needed to be removed. They were flagged as malicious because they contained the flatmap-stream npm package that is known bitcoin mining malware.

Due to miscommunication, this resulted in the removal of several extensions where only the older versions were flagged, and only those should have been removed. This affected your extension.

We realized it a few hours after and started taking action. This included communication to all package owners affected and trying to recover the extensions. At this time, latest version for these extensions is recovered and install counts restored. We will work to bring back other stats too, during business hours next week.

This caused a lot of disruption for the community, and for the team. We greatly appreciate everyone's patience and help!

We are currently doing an RCA. We are already implementing some of the repair items, to:

• Increase transparency by communicating such impactful actions to the publishers and community before we take them and after we take them
• Prevent the wrong action to be taken and look for gradual progression towards irreversible action
• Improve the ability to recover data (more, faster, easier)

Please let me know your feedback. We'd love to use it in our RCA!

Did you delete a 10-year project without notice because you didn't like it? Great! What a crisis-management!

[offspring]

OMFG
This is great product for embedded development

[ivankravets]

@mariaghiondea , do you have any updates on restoring the extension reviews? The PlatformIO IDE extension is important even for Microsoft itself. See Microsoft leverages PlatformIO for its course "IoT for Beginners"

We have many friends at Microsoft - should we attract them to solve your team's mistakes quickly?

[mariaghiondea]

We are in the process of restoring stats. At this time install counts and rating counts are restored. We are looking into reviews next.

[ivankravets]

@mariaghiondea , how is your progress? Do you have a backup of the reviews?

[ivankravets]

@mariaghiondea , 3 weeks... Any updates?

[mariaghiondea]

Apologies for the delay. I didn't have any meaningful updates to share yet.

Our first attempt to retrieve the rest of the metadata wasn't successful (through a regular process that we have).
We tested a different one successfully and are reviewing it more thoroughly before we apply. We want to make sure that everything goes smoothly.

We finished an RCA. This uncovered a few areas of improvement. We implemented/are in the process of implementing the repair items. Among those is the ability to restore data quickly and easy, as well as soft deletes to prevent these all together, and more awareness to the community before we take action. These will help with this case and prevention and recovery in the future too.

[ivankravets]

Do you mean you don’t have permission to the backup of Marketplace-related data? Or do you have the backup but can’t apply the changes to the master database? How can we help?

We can make this issue public to attract more attention. The problem is that people who deleted our extension might have been fired.

[mariaghiondea]

I realize that it's been a while since this happened. We are trying to be careful, but this is still a priority for us, we have the data and a plan to recover it.