# Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces

Publishers leaked 550+ secrets including 100+ VSCode Marketplace PATs and 30+ Open VSX tokens in extension packages, enabling malicious auto-updates to 150k installs.

- Payout: Research
- Severity: critical
- Program: Microsoft
- Write-up by: Wiz Research
- Disclosed: 2025-10-15
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/supply-chain-risk-in-vscode-extension-marketplaces
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-supply-chain-risk-in-vscode-extension-marketplaces
- Tags: area:cloud domain:infra domain:oss impact:integrity impact:mass-exploit kind:research platform:threat-intel sev:critical tech:ci-cd technique:recon technique:source-review vuln:secrets-leak

**Target:** VSCode/Open VSX extension packages (.vsix) and publisher access tokens
**Root cause:** Publishers bundled dotfiles (.env, config.json, mcp.json, .cursorrules) and hardcoded credentials into publicly downloadable .vsix packages, including Azure DevOps PATs and Open VSX tokens that authorize extension publishing.
**Steps:**
1. Download extension .vsix files from VSCode Marketplace or Open VSX
2. Unzip and inspect package contents for dotfiles and hardcoded secrets
3. Validate discovered secrets (e.g. Azure DevOps PATs, OVSX tokens) against marketplace APIs
4. Use a valid PAT to publish a malicious update to the extension, reaching its full install base via auto-update
**How found:** Started hunting malicious extensions in the VSCode Marketplace after February malware incidents; while inspecting .vsix packages, discovered publishers failed to sanitize hardcoded secrets and dotfiles, then pivoted to validating leaked publishing tokens.
**Exploitation:** A leaked Azure DevOps PAT or Open VSX access token lets an attacker publish a new version of the extension; default auto-update pushes the malicious update to all installs (85k+ via VSCode PATs, 100k+ via OVSX tokens).
**Escalation:** Targeting internal/vendor-specific extensions with low install counts enables targeted malware delivery to specific corporate workforces (e.g. a $30B market cap Chinese megacorp).
**Insight:** Extension packages are fully public archives: unzip .vsix files and grep for dotfiles (.env, mcp.json, .cursorrules) and publishing tokens; low-install vendor/internal extensions are high-value targets for targeted supply-chain attacks.