Open VSX Archives - Recon Bee

It has been discovered that well-known AI-powered Microsoft Visual Studio Code (VS Code) forks like Cursor, Windsurf, Google Antigravity, and Trae suggest extensions that aren't listed in the Open VSX registry, which could put supply chains at risk when malicious packages are published under those names. These integrated development environments (IDEs) inherit the list of officially recommended extensions from Microsoft's extensions marketplace, which is the issue, according to Koi. Open VSX does not have these extensions. There are two types of VS Code extension recommendations: software-based, which are recommended when relevant apps are already installed on the host, and file-based, which are shown as toast notifications when users open a file in a particular format. The probl...

Following an unintentional developer disclosure in public repositories, the Open VSX registry rotated access tokens, enabling threat actors to publish malicious extensions in a supply chain assault. When Wiz researchers announced that more than 550 secrets were exposed throughout the Microsoft VSCode and Open VSX marketplaces two weeks ago, they found the breach. According to reports, some of those secrets might grant access to projects with 150,000 downloads, enabling threat actors to upload malicious extension versions and posing a serious risk to the supply chain. The Eclipse Foundation created Open VSX, an open-source substitute for Microsoft's Visual Studio Marketplace, which provides VSCode IDE extensions. Open VSX is a community-driven registry for extensions compatible...

Tag: Open VSX

VS Code Forks Recommend Missing Extensions, Creating Supply Chain Risk in Open VSX

Open VSX rotates access tokens used in supply-chain malware attack