Extension Marketplace Changes - Transition to OpenVSX

Announcements Release Discussions
30

This was a strategic error : this strange marketplace is not even close to the industry’s security standards. Moreover, many many extensions are missing and porting them from VS Code makes it impossible to receive updates automatically. Switching client side and choosing a marketplace could be an alternative but how to do it?

Recent Malicious Extensions Statistics (from Koi Security research):

  • 1,283 extensions with known malicious dependencies (229M installs)

  • 267 extensions with hardcoded secrets

  • 145 extensions flagged by VirusTotal

  • 1,452 extensions running unknown binaries

ADDITIONAL RISK FACTOR: Lack of CVE Documentation

  • OpenVSX critical vulnerabilities (VSXPloit, namespace hijacking) have NO CVE numbers
  • This indicates poor vulnerability management practices by maintainers
  • Organizations cannot properly track/assess OpenVSX security risks
  • No standardized way to reference these vulnerabilities in security tools

OpenVSX integration represents a critical risk vector requiring immediate attention