Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks

New research from Wiz has revealed that publishers of over 100 Visual Studio Code extensions leaked access tokens that could let attackers push malicious extension updates, creating a serious software supply chain risk. The Wiz report found more than 550 validated secrets distributed across more than 500 extensions from hundreds of publishers, with over 85,000 installs accounted for by the leaked VS Code Marketplace PATs.

In a separate thread, the article notes a threat actor codenamed TigerJack has published at least 11 malicious VS Code extensions since early 2025, capable of stealing credentials, mining cryptocurrency, or delivering backdoors, with some extensions republished under new names after removal. Following disclosure to Microsoft in late March and April 2025, the company revoked the leaked PATs and announced secret scanning capabilities to block extensions with verified secrets and notify developers.

The article also cites that even though Microsoft has taken steps, the Open VSX registry remains a weaker link, and security experts urge limiting installed extensions, vetting them carefully, and maintaining an extension inventory or a central allowlist. Wiz emphasised that the situation underscores ongoing supply chain risks from extensions and plugins across repositories.