Open VSX

Profile narrative

The organisation, identified by the alias Open VSX, is associated with the Open VSX marketplace, a platform for publishing, distributing, and discovering extensions used with VS Code-compatible development environments. Its core service is an extension registry where software publishers can make development tools, language support, themes, debuggers, and related add-ons available to users. The marketplace is oriented toward developers and development-tool maintainers rather than general consumers. It supports the broader software-development ecosystem by providing a channel for extension distribution and updates. The supplied context identifies the organisation as having a headquarters location in Canada.

The available source material does not provide employee counts, funding details, revenue, or organisational size. It does provide one explicit footprint indicator: in the 2026-01-30 incident, four legitimate VS Code extensions on the marketplace had together exceeded twenty-two thousand downloads before malicious updates were distributed through them. This confirms that at least some extensions distributed through Open VSX can reach a material developer user base. The supplied material does not establish broader marketplace totals or overall user numbers.

Open VSX is positioned as a marketplace for VS Code extensions, with a role in the distribution of trusted extension updates from established publishers. In the 2026-01-30 incident, a threat actor compromised a publisher account and uploaded malicious updates to four legitimate extensions. This attack used the established publisher identity rather than typosquatting, showing that the marketplace’s trust model depends partly on publisher account security and the integrity of publishing credentials. Analysts attributed the breach to leaked publishing tokens or other unauthorized access. The poisoned extensions contained a runtime loader that checked for macOS, avoided systems with Russian locales, retrieved command-and-control instructions from Solana transaction memos, and deployed a GlassWorm implant. The implant was described as stealing browser data, cryptocurrency wallets, keychain information, notes, VPN data, and developer credentials such as AWS and SSH keys.

Open VSX is associated with the open-source development-tools sector and functions as infrastructure for extension distribution. The supplied context does not state a parent company, subsidiary network, or detailed corporate ownership structure. Its notable role is operating a publishing channel used by extension maintainers and developers. The 2026 incident also shows that compromise of publisher credentials can turn that distribution channel into a route for malware delivery through otherwise legitimate extensions.

Incidents

1 incident linked to this organisation.