Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces (www.wiz.io)

Wiz Research discovered a widespread secrets leakage problem in VSCode and Open VSX extension packages: over 550 validated secrets across more than 500 extensions from hundreds of publishers, including 100+ valid marketplace access tokens (Azure DevOps PATs and Open VSX tokens) that could be used to push malicious updates to extensions’ entire install bases. Because VS Code auto-updates extensions, an attacker with a leaked token could distribute malware at scale (Wiz estimates roughly 150k installs were exposed). Leaked credentials spanned AI-provider keys (OpenAI, Gemini, Anthropic, etc.), cloud and platform credentials (AWS, GitHub, GCP, Stripe), and databases; common leak sources were bundled dotfiles and config artifacts inside .vsix packages (.env, config.json, package.json, README.md). Wiz worked with Microsoft’s Security Response Center to notify publishers, revoke exposed PATs, and roll out platform mitigations—Microsoft scanned and asked owners to publish sanitized versions and launched Secret Detection for Extensions. Key takeaways for the AI/ML community: treat extensions and themes as supply-chain risk (themes can still carry malware), minimize installed extensions, weigh auto-update tradeoffs, and scan for secrets before publishing. Platform fixes recommended include short-lived secrets, identifiable token structure, and enrollment in advanced secret-scanning programs to reduce future mass-exposure incidents.