Eclipse Foundation Revokes Leaked Open VSX Tokens Following Wiz Discovery

Eclipse Foundation said it has revoked a small number of leaked Open VSX tokens found in Visual Studio Code extensions published in the marketplace, following a Wiz report earlier this month about exposed access tokens in public repositories. According to Mikaël Barbero, head of security at the Eclipse Foundation, the exposures were caused by developer mistakes rather than a compromise of the Open VSX infrastructure.

Open VSX has introduced a token prefix format ovsxp_ to help scan for exposed tokens in public repositories, in collaboration with the Microsoft Security Response Center. The registry maintainers also removed extensions recently flagged by Koi Security as part of a campaign named GlassWorm, and emphasised that the malware distributed did not spread as a self-replicating worm, since it first needed to steal developer credentials.

Open VSX is enforcing security changes, including reducing token lifetime by default, easier revocation on notification, and automated scanning of extensions at publication to detect secrets or malicious code.