Registry Token Leak Exposes Open VSX Supply-Chain Weakness

A significant security breach involving the open-source extension registry Open VSX Registry and maintained by Eclipse Foundation has exposed a vulnerability in the software-supply-chain ecosystem. Developer tokens that grant publish permissions were unintentionally made public, enabling threat actors to upload malicious extensions and target developers using the platform.

Security researchers from Wiz flagged more than 550 exposed secrets within public repositories, among which tokens belonging to Open VSX accounts were identified. The leaked tokens permitted unauthorised actors to publish or update extensions on the registry, raising alarms about the integrity of code distribution in the developer community.

The Eclipse Foundation’s response confirms that the root cause was human error—developers inadvertently committed tokens to public version-control systems—rather than a breach of Open VSX’s underlying infrastructure. Once identified, the tokens were revoked and all impacted extensions were removed from the registry.

One malware campaign tied to this incident has been termed “GlassWorm” by researchers at Koi Security. This operation used the compromised tokens to publish malicious extensions that appear benign at first, then target developer credentials and infrastructure. Despite the name, Open VSX says this campaign did not propagate autonomously like a classic worm, but required credential compromise to expand. Among the affected packages was one disguised as a popular Solidity-language extension, carrying a backdoor invoking Ethereum smart-contract functionality to deliver remote access capabilities.

Download figures circulating in the investigation suggest around 35,800 installs of the suspect extensions, but the registry maintainer cautions that the figure includes inflated counts generated by bots and visibility-manipulation tactics. Because of this, the actual user-impact is likely lower than the headline figure suggests.

In response to the incident, the Eclipse Foundation and Open VSX have enacted a number of security enhancements. Tokens issued for publishing now include a distinct prefix to enable easier detection of exposed credentials in public repositories, implemented in collaboration with Microsoft Security Response Center. Default token lifetimes have been reduced and a streamlined revocation process established to limit the risk exposure window. Automated security scanning of extensions will now run at publication time, enabling earlier detection of malicious code patterns. The registry is also enhancing partnerships with other marketplace operators to share threat intelligence and best practices for extension security.

Beyond the immediate fixes, the incident underscores a broader trend in the software-supply-chain domain: extensions, libraries and plugins represent high-leverage targets for adversaries seeking access to developer environments. Academic work has shown that extension ecosystems can leak credentials, and that a non-trivial share of extensions suffer from data-exposure risks. The decentralised nature of community-driven registries, while enabling innovation, may leave governance and security oversight less robust than enterprise-grade centres.

For development teams and organisations relying on extensions from Open VSX, steps such as verifying publisher authenticity, auditing extension behaviour and integrating secret-scanning tools in CI/CD pipelines are increasingly critical. The incident signals that, even when upstream infrastructure is well maintained, operational practices—especially around token management—remain a primary vector for exploitation.