Open VSX rotates tokens used in supply-chain malware attack

The Open VSX registry rotated access tokens after they were accidentally leaked by developers in public repositories and allowed threat actors to publish malicious extensions in an attempted ...
InfoWorld

Threat actors are spreading malicious extensions via VS marketplaces

There isn’t a consistent threat model for extension marketplaces yet, McCarthy said, making it difficult for any platform to anticipate these risks. However, he added, Microsoft’s marketplace has seen ...
How-To Geek on MSN

GitHub Is Making Open-Source Projects More Secure

Normally, when you upload a project to GitHub you're free to make revisions to that code at any time. In many cases, that ...
The Hacker News

Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack

GlassWorm spread via 14 VS Code extensions; Solana + Google Calendar C2; stole credentials, drained 49 wallets.

Self-spreading GlassWorm malware hits OpenVSX, VS Code registries

A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with ...

GitHub's new Agent HQ gives devs a command center for all their AI tools - why this is a huge deal

GitHub just brought Codex, Claude, and Jules together in one agentic development platform. Here's how it works and why it matters.