PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces

wiz.io | blog | #supply-chain | #secrets | #marketplace | #vscode | #open-vsx | #wiz-research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz Research uncovered 550+ valid secrets across 500+ VSCode and Open VSX extensions — over a hundred enabled malicious updates — and worked with Microsoft on marketplace guardrails.
Published
Collected

Related coverage

blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
blog · wiz.io
Leaking Secrets in the Age of AI
A month-long Wiz scan found AI-related credentials dominating valid secrets leaked to public repos — .ipynb notebooks, mcp.json, .env and agent configs — with valid keys tied to 30+ companies.
incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
research · wiz.io
Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks
Wiz scanned the Forbes AI 50 and found 65% of leading private AI companies had verified secret leaks on GitHub — API keys and tokens buried in deleted forks and gists that standard scanners miss.
incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
blog · wiz.io
LiteLLM Compromised, Steals Credentials
# LiteLLM Compromised, Steals Credentials In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a...
Back