Plugin spamming ipv4.icanhazip.com

[Peter Fotinis]

Extension: 1.3.1 / VS Code 1.33.1 / Windows 10 1809

It appears the plugin is configured to check if the internet connection is online every 1.5 seconds. It does so using the npm package “is-online”, which retrieves ipv4.icanhazip.com. This appears to be run per VSCode instance. The net result is a lot of requests hitting ipv4.icanhazip.com

Our firewall logs show on my machine started making a lot of requests at 2019-05-10T15:29:33.000Z. The culprit is the “is-online“ package added in commit f07be5252afda526aff6fc2e438e629db94a034b and used in the class “OnlineDetector“. I have not dug through the git log to see if there are any new consumers of the class more recently.

We began investigating these requests after being blacklisted on CloudFlare’s network. They were the only suspicious requests we could see.

[Stepan Konrad]

Looks like we are affected as well, I would vote for raising the priority as this seems to affect everybody.

[Jonathan Doklovic]

linked to:VSCODE-479

[Pramod Busam]

Version 1.4.0 of the extension fixes this issue. (Please note that you need to update to VS Code 1.34 to use this version)

[Alastair Wilkes]

Removing component: triaged (automated comment)