Open VSX rotates access tokens used in supply-chain malware attack

Open VSX access tokens were accidentally leaked by developers and subsequently abused to publish malicious extensions (the GlassWorm campaign) that targeted developer credentials and cryptocurrency wallet data via hidden Unicode payloads; the Eclipse Foundation and Open VSX rotated or revoked tokens and removed malicious extensions, containing the incident, while researchers report the actors have since shifted tactics and moved to GitHub.