Open VSX Token Exposure and GlassWorm Supply Chain Attack

Eclipse Foundation revoked a small number of leaked access tokens for the Open VSX extension marketplace after a report from Wiz revealed that several Visual Studio Code extensions had inadvertently exposed their tokens in public repositories. This exposure could have allowed attackers to take control of extensions and distribute malware, posing a significant supply chain risk. The foundation confirmed that the leaks were due to developer mistakes, not a compromise of Open VSX infrastructure, and has since implemented new security measures, including a token prefix format and reduced token lifetimes. Additionally, extensions flagged as part of the "GlassWorm" campaign by Koi Security were removed, and the foundation clarified that the reported download numbers were likely inflated by bots and threat actor tactics.

The GlassWorm campaign involved the use of hidden malicious code injected with invisible Unicode Private Use Area (PUA) characters, a technique previously observed in npm packages and now seen in compromised Open VSX extensions. Security researchers noted that the same threat actor has shifted focus to GitHub repositories, using increasingly stealthy methods to inject malware into legitimate-looking commits. The campaign highlights the evolving tactics of supply chain attackers and the importance of proactive security measures in open-source ecosystems.