MARKETPLACE TAKEOVER: HOW WE COULD'VE TAKEN OVER EVERY DEVELOPER USING A VSCODE FORK; PUTTING MILLIONS AT RISK

Summary from the TLDR InfoSec newsletter

Security researchers have discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace used by over 8 million developers across popular editors such as Cursor, Windsurf, and VSCodium. The flaw allowed attackers to steal admin credentials through a CI pipeline issue, enabling them to publish malicious updates to every extension on the marketplace and potentially compromise millions of developer machines. The vulnerability was responsibly disclosed in May and patched after multiple iterations over several weeks.