OpenVSX

OpenVSX is an open-source alternative registry for Visual Studio Code extensions, hosted by the Eclipse Foundation. It serves as the default extension marketplace for open-source VS Code derivatives including VSCodium and Eclipse Theia, and is used by organisations that operate air-gapped or self-hosted VS Code deployments that mirror an external registry rather than using Microsoft's proprietary VS Code Marketplace. Launched in 2020, it is a free community registry that allows any extension author to publish without a Microsoft account, making it the primary channel for extensions in sovereignty-sensitive and open-source deployment environments.

On 27 April 2026, the GlassWorm campaign turned 73 dormant OpenVSX extensions simultaneously malicious via staged updates, compromising developers who had those extensions installed and whose IDEs pulled the malicious update.

OpenVSX's governance model operates as an open community registry with less centralised review of extension updates compared to Microsoft's marketplace, making it structurally more exposed to the dormant-extension-update attack pattern GlassWorm exploited. The attack targeted extensions with an existing install base but no recent update activity — the extensions users stop auditing because nothing has changed. The GlassWorm incident will accelerate discussions inside the Eclipse Foundation on update-signing requirements and suspicious-update detection, and may prompt enterprise policies requiring internal extension mirrors with manual vetting rather than direct registry pulls.

OpenVSX is the third vector in a 13-day supply-chain attack window alongside TeamPCP (SAP npm) and a PyPI infostealer, collectively illustrating that the developer toolchain is now a primary lateral-movement attack surface.