Open VSX Registry

Open-source VS Code extensions

Open VSX is the vendor-neutral, Eclipse Foundation-run registry that backs editors like VSCodium, Windsurf, and Cursor. It mirrors much of the VS Code ecosystem (~19,000 packages) without Microsoft's curation — which is exactly why it has been used as a re-publication vector: the Count Dooku campaign pushed trojanized copies of legitimate VS Code extensions here, and GlassWorm spread between OpenVSX and the VS Code Marketplace. If your editor pulls from Open VSX rather than the Microsoft Marketplace, these are the scorecards that matter.

• –Malicious re-publication of popular VS Code extensions under lookalike publisher accounts
• –Payloads appended after source-map comments where diff tools do not look
• –Lower curation bar than the first-party marketplaces

Security intelligence powered by Risky Plugins