---
id: 6961
title: "Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/supply-chain-risk-in-vscode-extension-marketplaces"
published_at: "2025-10-15T12:00:01Z"
tags: ["supply-chain", "secrets", "marketplace", "vscode", "open-vsx", "wiz-research"]
phying_url: "https://phying.com/item/6961"
lang: en
---

# Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces

## Summary

Wiz Research uncovered 550+ valid secrets across 500+ VSCode and Open VSX extensions — over a hundred enabled malicious updates — and worked with Microsoft on marketplace guardrails.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-10-15T12:00:01Z
- **Original:** https://www.wiz.io/blog/supply-chain-risk-in-vscode-extension-marketplaces
- **Phying News:** https://phying.com/item/6961