Fake Solidity Tooling Turns the Editor Into a Theft Vector

A branded extension campaign aimed at web3 developers shows how a trusted code editor can become the first step in credential and wallet theft.

The Trusted Plugin Trap: How a Solidity-Branded VS Code Add-on Became a Secret-Clearing Risk

A malicious extension family tied to Solidity Pro put a familiar developer workflow under suspicion, showing how an editor plugin can become a high-value path to wallets, API keys, and credentials.

Fake Extension Ring Turns a Developer Marketplace Into a Quiet Reconnaissance Channel

Seventy-seven lookalike Open VSX packages show how trusted add-ons can become a low-friction way to collect environment intelligence from developer machines.

Lookalike Extensions, Shared Infrastructure, and the Quiet Theft of Trust

A wave of counterfeit VS Code add-ons on Open VSX shows how naming tricks can turn a software marketplace into a developer-risk channel.

Fake Trust, Real Reach: How Open VSX Became a Metadata Trap

Impersonated extensions on a developer marketplace show how a believable namespace can turn software trust into reconnaissance.

Phantom Extensions: The Secret Malware Army Lurking in the Open VSX Marketplace

Investigators uncover a sprawling network of cloned code extensions poised to unleash GlassWorm malware on unsuspecting developers worldwide.

Cracked Wide Open: How a Simple Logic Bug Nearly Turned Open VSX into a Malware Paradise

When “Nothing to Scan” Lets in the Crooks: The Silent Flaw in Open VSX’s Security Wall

A subtle software bug let bad actors slip malicious VS Code extensions past Open VSX’s security checks-no hacking required.

Gatekeepers at the Code Frontier: How Eclipse’s New Security Checks Aim to Thwart Extension Sabotage

The Eclipse Foundation is rolling out pre-publish security scans for Open VSX Registry extensions, targeting the growing threat of supply chain attacks.