Threat model and measurement · this page 1 November 2026
The shape. Open VSX is the registry VSCodium, Cursor and Windsurf install extensions from, run by the Eclipse Foundation. Anyone signs in with a GitHub account and publishes into a namespace; Open VSX marks a version verified only when the user who published it is a member of a namespace that has an owner. It signs every package it serves. Its own scan results are admin-only: the public signal is a review status on the record, and on an ordinary published version that field is absent. Its silence is never a pass. An extension runs with the user's permissions inside the editor, and the names that are familiar on the VS Code Marketplace can be published again here by someone else. This page is a threat model and a measurement: it names no extension or publisher. The campaigns' own listings are named, with their sources, on the malicious VS Code extensions page.
The live volume of the GlassWorm campaign family has been on Open VSX, not on the Microsoft Marketplace, and every date below is as the primary write-up states it.
Each of these is a shape a listing check can be built for: a new namespace nobody owns, a familiar name under a stranger, a pack that installs members nobody chose, a young listing re-published again and again. None of them is a shape a listing check can see when the code turns after the listing has aged, or when a real publisher's token is stolen; this page says so below.
Seventeen checks, numbered one for one with the VS Code Marketplace's and read from Open VSX's own record, the extension's manifest and the package's file list (the list):
Open VSX's own list of its 100 most-downloaded extensions, as read at the start of the run, each read live through the product's own checks with the production deadline.
| Sample | Extensions | PASS | REVIEW | BLOCK | Partial | Median time |
|---|---|---|---|---|---|---|
| Top 100 by downloads | 100 | 99 | 1 | 0 | 0 | 1.56 s |
The one REVIEW is a listing first published 30 days before the run, from a namespace Open VSX does not mark verified, that runs code in the editor, with a declared repository that could not be read. That is the shape the roster is meant to review, not a misread. A first run the same morning gave 97 PASS and 3 REVIEW; its two misreads (VS Code's own built-in namespace read as a lookalike, and a namespace tied to its repository only through the publisher's GitHub login) were fixed before the run above, and both runs' rows are kept.
What the 100 look like. 98 are verified. All 100 carry Open VSX's signature, none has a review status other than published, and none is deprecated. 95 declare a source repository: 93 of those repositories are REVIEW through the 22 checks, 2 PASS and none BLOCK, so the rule that makes a BLOCK source a BLOCK extension never fired. 94 run code in the editor. On these established listings almost everything is a note, which is the grading: a note is shown, and costs nothing. None of these figures is a catch rate. A PASS means nothing matched on what was read; it is not an audit.
| Check | Finding | Note only |
|---|---|---|
| O1 Namespace ownership | 1 | 1 |
| O2 Extension age | 0 | 0 |
| O3 Traction mismatch | 0 | 0 |
| O4 Lookalike of a Marketplace extension | 0 | 0 |
| O5 Source repository | 0 | 100 |
| O6 Open VSX signature | 0 | 0 |
| O7 Declares code execution | 1 | 93 |
| O8 Proposed API access | 0 | 10 |
| O9 Extension pack and dependencies | 0 | 19 |
| O10 Pre-release and re-publish cadence | 0 | 13 |
| O11 Open VSX review status and deprecation | 0 | 0 |
| O12 Package contents | 0 | 24 |
| O13 Agent config files | 0 | 6 |
| O14 Hidden Unicode in agent rules | 0 | 0 |
| O15 MCP shell-launch config | 0 | 0 |
| O16 Credential redirect | 0 | 0 |
| O17 AI-agent provenance | not checked | not checked |
Extensions on which the check was a finding (medium or
above), and extensions on which it wrote only a note. The rows are in the
repository as docs/rg168-ovsx-rows-2026-11-01.jsonl.
The same code was run on the twelve campaign listings in the published record. Every one answers 404 from Open VSX today: removed, so “not assessable”, a warning, never a pass. With the campaign blocklist, the eight confirmed ones are BLOCK and the four suspected sleepers REVIEW: a removed name can be published again, and the blocklist is what denies it. No live Open VSX listing that is malicious today was available to measure, so the clone and review-status rules are pinned by tests, not by a catch.
The verdict is served on the API
(/v1/ovsx/score/{namespace}/{extension}) and through the MCP
server (platform="ovsx"). In Claude Code with the RepoGates
plugin, an open-vsx.org address and a codium,
vscodium, cursor or windsurf
--install-extension line are judged on Open VSX's checks; that
line is read against both Open VSX and the VS Code Marketplace, because
it cannot show which registry the editor uses, and
code --install-extension stays the Marketplace's. There is
no board on Open VSX's pages, and the browser's download gate does not
read open-vsx.org.
It does not see git clone, package managers or
curl — outside Claude Code with the RepoGates plugin, whose
hook refuses a clone or install that names a blocked repository on the
command line, before it runs. The hook sees Bash tool calls in that one
client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. An extension installed from the
editor's own UI, or one that auto-updates, is not a shell line the hook
sees. The extension's code bundle is not read on this tier, so a sleeper
that turns after its listing has aged, and a loader inside the
JavaScript, are not seen; nor is a real publisher's stolen token, which
publishes as that publisher. Open VSX's own scan results are
admin-only and not read.