🧰 Open VSX

The items that name it 30

• Backdoors in official Claude Code extensions
  threadas classification.technologies2026-10-30
• Trojanized Claude Code Extension Plants an SSH Backdoor
  writeupas tools2026-10-30

  Extension registry from which the analyzed trojanized extension was obtained

• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
  writeupas classification.technologies2026-10-30
• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  articleas classification.technologies2026-10-30
• Software supply chain security best practices for 2026
  articleas affected products2026-10-21It is written here as OpenVSX.
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas affected products2026-10-12It is written here as OpenVSX.
• Introducing Socket Scanning for VS Code Marketplace Extensions
  articleas classification.technologies2026-10-06
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeupas classification.technologies2026-10-02
• SolarWinds took a nation-state. The next attack just needs an LLM and $5. | Blog | Endor Labs
  articleas affected products2026-09-11It is written here as OpenVSX.

  Ecosystem compromised by TeamPCP as part of the March 2026 cascade.

• Socket: Open VSX Unblocks Extension IDs Used in Malware Campaign
  articleas tools2026-08-24

  Open-source VS Code extension registry/marketplace; maintains a malicious-extension list (array of ID strings) used to block known-bad extensions; introduced immutable extension versions and a preview changes feed on August 12.

• Shai-Hulud was the best thing to happen to supply chain security
  articleas classification.technologies2026-08-24
• 77 "Evil Twin" Open VSX Extensions
  articleas classification.technologies2026-08-08
• Xygeni Malicious Code Digest 82
  articleas affected products2026-08-08It is written here as OpenVSX.

  Registry monitored/scanned for malicious packages

• OpenSourceMalware Blog
  articleas affected products2026-07-18

  Discussed via interview with Head of Security.

• The OpenSourceMalware Show #12
  talkas affected products2026-07-09

  Open source VS Code-compatible extension marketplace/registry run by Eclipse Foundation; grew from a niche project to critical infrastructure for AI-assisted IDEs (Cursor, IBM Project Bob, Google Antigravity, AWS Kiro); ~12,000-15,000 extensions, 8,000+ publishers; downloads grew from 300 million/mo

• The OpenSourceMalware Show #11
  talkas affected products2026-07-02

  Extension registry managed by the Eclipse Foundation, used by AI IDE platforms like Cursor and Windsurf instead of the official VS Code marketplace; increasingly targeted by threat actors

• The OpenSourceMalware Show #10
  talkas affected products2026-06-25It is written here as OpenVSX.
• Socket: Firewall Now Blocks Malicious VS Code and Open VSX Extensions
  articleas affected products2026-06-18

  Marketplace used by Cursor, Windsurf, VSCodium, Antigravity, and other VS Code-based editors; target of repeated GlassWorm attacks.

• Socket: GlassWASM
  writeupas classification.technologies2026-06-16
• The OpenSourceMalware Show #8
  talkas affected products2026-06-11It is written here as OpenVSX (Eclipse Foundation marketplace).

  Eclipse Foundation marketplace

• Secret Scanning Dev Workstations with bagel + Fleet
  writeupas affected products2026-06-04It is written here as OpenVSX.

  Extension registry cited as expanding workstation attack surface.

• Nx Console VS Code Extension Compromised
  writeupas affected products2026-06-02It is written here as OpenVSX.

  stated as not affected

• Open Source Malware Podcast — episodes
  otheras affected products2026-05-22

  Security improvements discussed

• JFrog: The Governance Gap Between Your Policy and Your Pipeline
  articleas affected products2026-05-21It is written here as OpenVSX.

  Registry where JFrog found 56 malicious IDE extensions.

• The Wild West of VS Code extensions and how a poisoned extension breached GitHub
  articleas classification.technologies2026-05-20It is written here as OpenVSX.
• GitHub breached via a malicious VS Code extension: why developer devices are the real target
  articleas tools2026-05-20

  Alternative extension marketplace; malicious Nx Console version pulled within 36 minutes here

• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas classification.technologies2026-05-20
• Socket: 73 Open VSX Sleeper Extensions Linked to GlassWorm
  writeupas classification.technologies2026-05-06
• Dev Machine Guard Now Supports Linux - StepSecurity
  articleas classification.technologies
• Dev Machine Guard Now Supports Windows - StepSecurity
  articleas classification.technologies