""A leaked VSCode Marketplace or Open VSX PAT [personal access token] allows an attacker to directly distribute a malicious extension update across the entire install base," Wiz security researcher Rami McCarthy said in a report shared with The Hacker News. "An attacker who discovered this issue would have been able to directly distribute malware to the cumulative 150,000 install base.""
"In all, Wiz said it found over 550 validated secrets, distributed across more than 500 extensions from hundreds of distinct publishers. The 550 secrets have been found to fall under 67 distinct types of secrets, including - AI provider secrets, such as those related to OpenAI, Gemini, Anthropic, XAI, DeepSeek, Hugging Face, and Perplexity Cloud service provider secrets, such as those related to Amazon Web Services (AWS), Google Cloud, GitHub, Stripe, and Auth0 Database secrets, such as those related to MongoDB, PostgreSQL, and Supabase"
"Wiz also noted in its report that more than 100 extensions leaked VS Code Marketplace PATs, which accounted for over 85,000 installs. Another 30 extensions with a cumulative install base of no less than 100,000 have been found to Open VSX Access Tokens. A significant chunk of the flagged extensions are themes. With Open VSX also integrated into artificial intelligence (AI)-powered VS Code forks like Cursor and Windsurf, extensions that leak access tokens can significantly expand the attack surface."
Over 550 validated secrets were found across more than 500 VS Code extensions from hundreds of distinct publishers. The secrets span 67 types, including AI-provider, cloud service provider, and database credentials. More than 100 extensions leaked VS Code Marketplace personal access tokens, affecting over 85,000 installs, while roughly 30 extensions leaked Open VSX access tokens, affecting at least 100,000 installs. Many flagged extensions are themes. VSIX-distributed extensions can be unzipped and inspected, exposing embedded hard-coded secrets. Leaked tokens can enable attackers to distribute malicious extension updates across large install bases, widening the attack surface.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]