Full Report
Learn how one overlooked flaw in OpenVSX discovered by Koi Secureity could've let attackers hijack millions of dev machines via an extension supply chain attack. The zero-day threat's been patched—but the wake-up call is clear: extensions are a new, massive supply chain risk. [...]
Analysis Summary
# Vulnerability: Supply Chain Takeover in OpenVSX Leading to Full Marketplace Compromise (VSXPloit)
## CVE Details
- CVE ID: Not explicitly provided in the text (Described as a zero-day discovered and responsibly disclosed, likely pending or assigned post-disclosure).
- CVSS Score: Not explicitly provided. (The description implies Critical severity due to "full-system compromise" potential).
- CWE: Assumed to relate to Improper Access Control or Insecure Direct Object Reference/Abuse of Functionality within the build process.
## Affected Systems
- Products: OpenVSX (the marketplace powering extensions for VS Code forks).
- Versions: Versions of the OpenVSX nightly build/automation process *prior* to the patch deployment.
- Configurations: Any developer machine running VS Code forks (e.g., Cursor, Windsurf, VSCodium) that automatically update extensions installed via OpenVSX.
## Vulnerability Description
The vulnerability existed within the automated nightly build process of OpenVSX. This process uses a powerful secret token belonging to the trusted `@open-vsx` account to build and publish extensions. The flaw allowed any extension author submitting a pull request to add an extension to the `extensions.json` list to trigger the execution of arbitrary code during the build phase. This code—which could be hidden in a direct submission, a dependency, or a dependency of a dependency—was capable of silently capturing the `$@open-vsx` secret token. Possession of this token grants "super-admin" control, enabling the attacker to publish new extensions, overwrite existing, trusted extensions, and silently push malicious updates to every user of the marketplace.
## Exploitation
- Status: Discovery/Proof Concept in a lab environment. Not explicitly stated as **Exploited in the wild** prior to disclosure.
- Complexity: Low (Attacker only needs to submit a malicious PR or dependency to the list, and the system handles the rest automatically).
- Attack Vector: Network (via malicious extension submission/dependency) leading to Local compromise following automated update.
## Impact
- Confidentiality: High (Code execution allows for stealing credentials, cookies, access to local files).
- Integrity: Critical (Complete takeover and ability to modify/replace any extension in the ecosystem).
- Availability: High (Potential for widespread disruption via malicious payloads installed across millions of developer machines).
## Remediation
### Patches
- The vulnerability has been closed following responsible disclosure and collaboration between Koi Security and the Eclipse Foundation maintainers of OpenVSX. Specific patch version information is not provided, but users should update OpenVSX infrastructure components to the latest versions released after the disclosure window.
### Workarounds
- Treat all extensions as untrusted dependencies.
- **Inventory Management:** Maintain a real inventory of installed extensions and their provenance.
- **Risk Assessment:** Assess the risk of extensions based on maintainer and code activity.
- **Policy Enforcement:** Enforce policies strictly limiting which extensions are allowed.
- **Continuous Monitoring:** Continuously monitor extensions for silent updates that could introduce new risks.
## Detection
- **Indicators of Compromise (IoCs):** Since the exploitation path targets the build server's secret token, detection efforts should focus on unauthorized outbound network activity or unusual file system access originating from the OpenVSX build infrastructure during nightly runs. On end-user machines, IoCs would manifest as the execution of malicious payloads (e.g., keyloggers, data exfiltration) delivered via silently updated extensions.
- **Detection Methods and Tools:** Standard dependency scanning tools and software supply chain security platforms capable of tracking extension lineage and runtime behavior are recommended. Organizations should enforce a "zero trust" posture for all extensions.
## References
- Vendor Advisory: Research published by Koi Security regarding the marketplace takeover.
- Relevant links:
- hxxps://blog[.]koi[.]security/marketplace-takeover-how-we-couldve-taken-over-every-developer-using-a-vscode-fork-f0f8cf104d44
- hxxps://www[.]koi[.]security