Open VSX
Security incidents tagged Open VSX. Newest first.
0 Open VSX incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 356
- Longest quiet run: 367 days (Oct 21–Oct 22)
Show 1 older incident1 older incident
October 2025 1
HighGlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible UnicodePatched
VS Code extensions on OpenVSX and the VS Code Marketplace Patched
Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.
