77 malicious Open VSX extensions found harvesting developer system data
A supply-chain attack on the Open VSX marketplace shows how fake extensions can steal environment info — and what developers can do to stay safe.
Security researchers have identified 77 extensions on the Open VSX marketplace that were impersonating legitimate developer tools. These malicious extensions transmitted information about the systems and development environments where they were installed, effectively harvesting data from developers who unknowingly installed them.
The Open VSX marketplace is an open-source alternative to Microsoft’s Visual Studio Code Marketplace, used by developers who prefer open ecosystems or need offline access. The impersonated extensions likely mimicked popular tools like linters, formatters, or debuggers to trick developers into installing them.
As of the report, the exact data collected and the identities of the attackers remain unclear, but the incident highlights a growing trend of supply-chain attacks targeting developer tools and package registries.
Why it matters
This event underscores the vulnerability of open-source software supply chains, where a single malicious extension can compromise many development environments. As more organizations adopt open-source tools, attackers increasingly target these ecosystems to gain access to sensitive code, credentials, and infrastructure. Developers and security teams must treat extensions and packages as potential attack vectors, not just productivity aids.
This event underscores the vulnerability of open-source software supply chains, where a single malicious extension can compromise many development environments.
Attacker creates fake extension
Impersonates a popular developer tool like a linter or formatter
Extension published on Open VSX
Marketplace lacks strong vetting, so malicious code passes review
Developer installs the extension
Trusts the name and icon, unaware it is a fake
Extension harvests system data
What you can learn from this
Supply-chain risk awareness: Every extension or package you install is a potential entry point for attackers. Malicious actors often impersonate popular tools to trick developers into installing them. Always verify the publisher, check download counts, and read reviews before installing a new extension.
Least privilege for development environments: Your development machine likely has access to source code, API keys, and cloud credentials. If an extension runs with full system permissions, it can exfiltrate all of that. Practice running extensions in isolated environments, such as containers or virtual machines, and limit what each extension can access.
Extension marketplace vetting: Not all marketplaces have the same security checks. Open VSX is community-driven and may have less rigorous review than proprietary alternatives. Before using a marketplace, understand its vetting process and consider using only extensions from trusted publishers or those with verified signatures.
Monitoring for anomalous behavior: Malicious extensions often send data to external servers. Use network monitoring tools or firewall rules to detect unexpected outbound connections from your development environment. Simple tools like
netstatorlsofcan help you spot suspicious activity.Regular audits of installed extensions: Periodically review the extensions you have installed and remove any you no longer use. This reduces your attack surface. Keep a list of approved extensions for your team and enforce it through policy or tooling.
We teach this
Sources
- 77 Open VSX extensions found harvesting developer info — BleepingComputer
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report