Wiz Finds 550 Leaked Secrets in VSCode Extensions, Including Tokens That Could Enable Malicious Updates
Summary
Wiz found over 550 secrets in more than 500 VSCode and Open VSX extensions, including over 100 tokens that could enable malicious updates affecting a reported 150,000 installs. Microsoft revoked marketplace tokens and added secret scanning and blocking.
Key points
- Wiz said it validated over 550 secrets across more than 500 extensions from hundreds of publishers, including AI, cloud, database, and other service credentials.
- More than 100 leaked VSCode Marketplace tokens and over 30 Open VSX tokens could let an attacker publish malicious extension updates; Wiz estimated the affected install base at a combined 150,000.
- The secrets were commonly exposed in bundled dotfiles, especially .env files, as well as extension source code, configuration files, and documentation.
- Wiz reported the issue to Microsoft’s Security Response Center in March 2025 and worked with Microsoft on remediation.
- Microsoft revoked every leaked VSCode Marketplace personal access token, notified affected publishers, and introduced scanning that blocks extensions containing verified secrets.
- Microsoft also scanned existing extensions and planned to work with publishers to remove exposed secrets; Open VSX is adding the ovsxp_ token prefix.
- Wiz advised users to limit extensions and assess publisher trust, and recommended that organizations maintain extension inventories and consider allowlists.
Article Details
- Event Type
- Supply-chain security disclosure involving exposed publisher access tokens in VSCode and Open VSX extension packages.
- Impact
- Wiz Research found more than 550 validated secrets across over 500 extensions. More than 100 leaked VSCode Marketplace personal access tokens and more than 30 Open VSX access tokens could allow extension updates to reach a combined install base exceeding 150,000. The article describes the ability to distribute malware as a potential impact; it does not report that attackers successfully used the tokens to do so. Microsoft revoked the leaked Visual Studio Marketplace tokens and introduced secret scanning and blocking measures.
Vendors
Products
Open VSXof secret leakage by publishers of VSCode IDE Extensions. This occurred across both the VSCode and Open VSX marketplaces, the latter of which is used by AI-powered VSCode forks like Cursor and Windsurf.VSCode Marketplaceitself. By default, VS Code will auto-update extensions as new versions become available. A leaked VSCode Marketplace or OpenVSX PAT allows an attacker to directly distribute a malicious extension update across the