In October 2025, Wiz Research published the results of a months-long investigation with Microsoft into secrets leaked inside Visual Studio Code extensions. Extensions are distributed as .vsix packages that anyone can unzip, and many publishers had shipped secrets inside them. Wiz found more than 550 validated secrets across more than 500 extensions from hundreds of publishers, covering 67 types: AI provider keys for OpenAI, Gemini, Anthropic, xAI, DeepSeek, Hugging Face and Perplexity; cloud and platform credentials for AWS, GitHub, Stripe, Auth0 and GCP; and database credentials. The most dangerous were publishing tokens. Wiz found more than 100 valid VS Code Marketplace personal access tokens and more than 30 Open VSX access tokens, which would let anyone push an update to those extensions. Because VS Code updates extensions automatically, those tokens together reached an install base of about 150,000. Microsoft revoked every leaked Marketplace token and now blocks extensions containing verified secrets. The risk was not only theoretical: the Open VSX registry later said a malware campaign known as GlassWorm had used some leaked publishing tokens to publish malicious extensions.
Key takeaways
- Wiz found more than 550 validated secrets in more than 500 VS Code extensions, many of them AI provider keys.
- More than 100 VS Code Marketplace PATs and more than 30 Open VSX tokens leaked, each able to publish updates to the publisher's extensions.
- With auto-update, the leaked publishing tokens could have delivered malware to an install base of about 150,000.
- Open VSX said the GlassWorm malware campaign used some leaked publishing tokens to publish malicious extensions; Microsoft and Open VSX revoked the leaked tokens.
- The identity lesson: a package is a public artefact, and a publishing token inside it hands control of every install to whoever finds it.
At a glance
| Organisations | Hundreds of VS Code extension publishers; Microsoft (VS Code Marketplace); Eclipse Foundation (Open VSX); Wiz (research) |
|---|---|
| When | Research from February 2025; published 15 October 2025 |
| Attacker | The operators of the GlassWorm malware campaign, reported by Koi Security, used some leaked Open VSX tokens, according to Open VSX; unattributed |
| Entry point | Secrets bundled in extension packages, most often in .env and other hidden files |
| Identities abused | VS Code Marketplace PATs and Open VSX publishing tokens; AI provider, cloud, payment and database secrets |
| Impact | More than 550 secrets exposed; publishing tokens reaching about 150,000 installs; some leaked tokens used to publish malicious extensions (GlassWorm); tokens revoked |
| Category | NHI. Incident class: confirmed NHI breach (leaked extension publishing tokens used to publish malicious extensions) |
What happened
Wiz started out looking for malicious extensions after attackers began targeting the VS Code Marketplace in February. "While we did end up identifying several interesting malicious extensions, we stumbled on something much more impactful: a scourge of secrets leaking in extension packages," wrote Rami McCarthy, principal security researcher at Wiz. "VSCode extensions are distributed as .vsix files, which can be unzipped and inspected. However, we found that publishers often failed to consider that everything in the package was publicly available."
The biggest risk came from publishing tokens. "Over one hundred valid leaked VSCode Marketplace PATs were identified within VSCode Marketplace extensions. Together, they represent an install base of over 85,000 extension installs," Wiz wrote, and more than thirty Open VSX tokens represented over 100,000 more. Themes contributed much of that install base, even though they carry no code, "there is no technical control preventing themes from bundling malware." In one case, a leaked token would have allowed Wiz to push targeted malware to the workforce of what it called "a $30 billion market cap Chinese megacorp." The largest source of leaks was bundled hidden files, especially .env files, with a growing share from AI configuration files such as mcp.json and .cursorrules.
Microsoft revoked every leaked Marketplace PAT, notified publishers and added secret scanning that blocks extensions with verified secrets, which The Register reported came into force on 22 September. On 27 October, the Open VSX team said it had revoked affected tokens, introduced a token prefix to make them easier to detect and would shorten token lifetimes. It also said that "a separate report from Koi Security described a new malware campaign that leveraged some of these leaked tokens to publish malicious extensions," known as GlassWorm, and that it considered that incident contained on 21 October.
Timeline
| Date | Event |
|---|---|
| February 2025 | Wiz begins investigating malicious VS Code extensions and finds leaked secrets. |
| 22 September 2025 | Microsoft starts blocking extensions that contain verified secrets, according to The Register. |
| 15 October 2025 | Wiz publishes its findings. |
| 21 October 2025 | Open VSX considers the related GlassWorm incident contained. |
| 27 October 2025 | Open VSX publishes its security update. |
How it happened: the identity attack path
- Secrets bundled. Publishers packaged .env files, configuration and source containing secrets.
- Packages published. Anyone could download and unzip the extensions.
- Publishing tokens exposed. Some packages contained the token used to publish the extension itself.
- Update path open. A malicious update pushed with such a token would reach users through auto-update.
- Abuse and revocation. Some leaked Open VSX tokens were used by the GlassWorm campaign; Microsoft and Open VSX revoked tokens and added scanning.
Impact
- Exposed: more than 550 validated secrets of 67 types.
- Supply chain risk: publishing tokens covering about 150,000 extension installs.
- Misuse: Open VSX reported that the GlassWorm campaign, described by Koi Security, used some leaked tokens to publish malicious extensions; it considered that incident contained on 21 October 2025.
What this means for NHI governance
Developer tools are now part of the identity attack surface. An extension publisher's token is a non-human identity with the power to run code on every machine that installed the extension. Shipping that token inside the extension is the same as publishing it. The AI provider keys Wiz found show a related trend: developers building AI features into tools embed the keys, and those keys go wherever the package goes.
Publishers need secret scanning before every release, publishing tokens with short lifetimes and narrow scope, and separate credentials for build and publish. Organisations need an inventory of the extensions their developers use. See our Secrets Management Guide, API Key Management Guide and AI Coding Agents Security Guide.
Recommendations
- Scan packages before publishing. Exclude dotfiles and check for secrets in every build. See our Secrets Management Guide.
- Use short-lived, scoped publishing tokens. Expiry limits the damage of a leak, as Wiz observed with expired 2023 tokens. See the CI/CD Pipeline Identity Security Guide.
- Rotate secrets found in published packages. Removing them from a new version does not revoke them. See the Leaked Credential Response Playbook.
- Keep an inventory of IDE extensions. Consider an allow-list for corporate machines.
- Do not publish internal extensions publicly. Distribute them through private channels.
Frequently asked questions
How many VS Code extensions leaked secrets?
Wiz found more than 550 validated secrets across more than 500 extensions from hundreds of publishers, in both the VS Code Marketplace and Open VSX.
Why are leaked publishing tokens so dangerous?
A publishing token lets anyone push a new version of the extension. VS Code updates extensions automatically, so a malicious update would reach every user; Wiz estimated about 150,000 installs.
Were the leaked tokens abused?
Yes, in part. Open VSX said the GlassWorm malware campaign, reported by Koi Security, used some leaked tokens to publish malicious extensions. The tokens Wiz reported were revoked.
Related NHI Mgmt Group resources
Nx s1ngularity Attack 2025 · Secrets in Docker Hub Images · Secrets Management Guide · API Key Management Guide · AI Coding Agents Security Guide
How NHI Mgmt Group can help
Publishing tokens and embedded keys travel with every package. We help teams scan releases, scope publishing credentials and respond when a token ships by mistake. See our NHI and AI agent security training.
References
- Wiz: Supply Chain Risk in VSCode Extension Marketplaces (15 October 2025)
- The Register: Devs are writing VS Code extensions that blab secrets by the bucketload (15 October 2025)
- DevOps.com: Massive VS Code Secrets Leak Puts Focus on Extensions, AI: Wiz (15 October 2025)
- Eclipse Foundation / Open VSX: Open VSX security update, October 2025 (27 October 2025)