OPEN LINK ↗
// 5h agoSECURITY INCIDENT
Open VSX Unblocks Malware-Tainted Extension IDs
Open VSX removed three extension IDs from its malicious-extension list after legitimate maintainers proved ownership of names abused in a 77-extension evil-twin campaign. Two clean packages are now live, but the incident exposes how ID-only blocklists can blur the line between malicious and legitimate versions.
// ANALYSIS
This is the right outcome for legitimate maintainers, but it reveals a serious supply-chain tracking gap: extension identity cannot safely be reduced to a name string.
- –The blocklist lacks version, hash, publisher, repository, and date metadata, making reclaimed IDs difficult to distinguish from their malicious predecessors.
- –The campaign harvested system, workspace, and CI metadata, showing why VS Code-compatible extensions deserve software-supply-chain scrutiny.
- –Teams should pin exact extension versions and hashes, verify publishers, and audit `.vscode/extensions.json` and devcontainer configurations.
- –Open VSX underpins VSCodium, Eclipse Theia, Gitpod, and several AI-native editors, raising the impact of marketplace security failures.
// TAGS
open-vsx-registrysecuritydevtoolopen-sourcehosted-serviceci-cd
DISCOVERED
5h ago
2026-08-24
PUBLISHED
23h ago
2026-08-24
RELEVANCE
8/ 10
AUTHOR
SocketSecurity