DISMANTLING A CRITICAL SUPPLY CHAIN RISK IN VSCODE EXTENSION MARKETPLACES

Summary from the TLDR InfoSec newsletter

Over 550 sensitive secrets, including AWS and GitHub tokens, were exposed in public VSCode extensions. This was primarily due to insecure file handling, which attackers could exploit to push malicious updates and launch supply chain attacks. In response, platforms revoked compromised tokens, notified publishers, and improved scanning.