500+ VSCode Extensions Expose Sensitive Credentials

Executive Summary

In October 2025, Wiz revealed a significant cybersecurity breach within the VSCode extension ecosystem, exposing hard-coded secrets in over 500 extensions. This supply-chain vulnerability affected both the official marketplace and alternative registries, such as Open VSX. Researchers initially investigated suspicious activities related to malware infiltration, only to uncover that numerous legitimate extensions had unintentionally included sensitive access tokens and credentials. As VSCode auto-updates these extensions, attackers could potentially hijack developer toolchains, push malicious updates, and exfiltrate sensitive information. This incident underscores the critical need for enhanced security practices in software development.

 Read the full breach analysis from NHI Mgmt Group here

Key Details

Breach Timeline

• October 2025: Wiz discloses the discovery of hard-coded secrets in VSCode extensions.
• Ongoing investigations revealed this was part of a larger supply-chain vulnerability.

Data Compromised

• Over 500 VSCode extensions were found to contain sensitive access tokens and credentials.
• Compromised secrets included API keys and database credentials, which could lead to severe data breaches.

Impact Assessment

• Attackers could hijack developer toolchains, leading to the potential deployment of malicious updates.
• This vulnerability could affect thousands of developers relying on these extensions for their workflows.

Company Response

• Wiz promptly alerted extension developers and the broader community to mitigate risks.
• Recommendations were made to remove hard-coded secrets and implement code reviews.

Security Implications

• This incident highlights the importance of secure coding practices in software development.
• Developers are urged to adopt security tools that can scan for hard-coded secrets before deployment.

 If you want to learn more about how to secure NHIs including AI Agents, check our NHI Foundational Training Course.