Leaks in Microsoft VS Code Marketplace Put Supply Chain at Risk

Researchers uncovered more than 550 unique secrets exposed in Visual Studio Code marketplaces, prompting Microsoft to bolster security measures, according to Wiz. The findings also revealed more than 130 tokens, including Azure DevOps Personal Access Tokens for the VS Code Marketplace and Open VSX access tokens, that could allow unauthorized individuals to poison extensions and inflate supply-chain risks.

The Wiz team also examined the Open VSX Registry, an open-source alternative to the VS Code Marketplace managed by the Eclipse Foundation, and noted a rise in secrets found in AI-related configuration files as well as database secrets for MongoDB, Postgres and Supabase. Microsoft moved to address the issue in June by unveiling new security measures that let publishers scan extensions for secrets before publication, and it is scanning all existing extensions in the marketplace.

Wiz reported leaking secrets to Microsoft in late March and early April, and Open VSX Registry is adding a new prefix to its access tokens as a precaution. Organizations are advised to review extension trust criteria, limit installed extensions, and consider an allow list to mitigate risks.