Open VSX Registry Responds to Leaked Tokens and Malicious Extension Incident

Open VSX Registry, run by the Open VSX team and the Eclipse Foundation, addressed a significant security incident involving leaked authentication tokens and malicious extensions on their code marketplace, and said the situation is now contained. The tokens were exposed in public repositories and belonged to Open VSX accounts; some were compromised and used maliciously, though the exposure was attributed to developer mistakes rather than a breach of Open VSX infrastructure.

The organisation revoked all affected tokens immediately and, to bolster detection, collaborated with Microsoft’s Security Response Center (MSRC) to introduce a special token prefix format that eases scanning of public repositories for exposed tokens before attackers can exploit them.

Security firm Koi Security linked a malware campaign dubbed “GlassWorm” to these exposed tokens, with extensions designed to steal developer credentials; Open VSX clarified the campaign did not rely on self-replication and noted that reported download figures of 35,800 were likely overstated due to bot activity.

As of 21 October 2025, the incident was considered fully contained, and the platform is implementing shorter token validity periods, streamlined revocation procedures, automated security scanning, and expanded threat intelligence collaboration. According to Microsoft’s Security Response Center (MSRC).