Blocklisting by extension ID has a shelf life: Open VSX cleared three names in five days

An identifier is the weakest thing a registry can revoke. Open VSX's public extension-control file represents malicious extensions as an array of ID strings, with no version, no file hash, no publisher account, no repository, and no date attached to an entry ^[8]. That is sufficient while every build under a name is hostile. It stops being sufficient the day the copied project shows up holding the same name.

RumbleDB's case shows where enforcement actually sits in the pipeline. The legitimate JSONiq and XQuery extension was uploaded, then vanished from the registry a few hours later, because rumbledb.jsoniq-vscode was still on the malicious list ^[7]. The publish succeeded; distribution did not. Al Duncan's first attempt failed earlier and more loudly, with the registry answering that AlDuncanson.react-hooks-snippets is a known malicious extension ^[5].

The clock is worth reading closely. Open VSX had removed all 77 packages and added their IDs to the list by August 3 ^[4], and the three removals landed on August 16, 18 and 20 ^[1], so the names sat blocked against their own owners for 13, 15 and 17 days after the malicious artifacts were already gone ^[13]. Once cleared, shipping was quick: the OPM maintainer's August 16 request produced a working 0.9.0 on August 21, five days later ^[14], and RumbleDB's 1.6.0 went live three days after its ID came off the list ^[15].

Version numbers are where the ambiguity bites. The deleted impostor packages carried 0.0.1; the legitimate releases now occupying two of those names are 0.9.0 and 1.6.0 ^[9]. Anything that recorded only the string, and there is a lot of tooling that records only the string, cannot tell those apart. The removals are preserved in the file's Git history ^[9], which means the authoritative record of what was malicious is now a commit log rather than the artifact the registry serves to scanners.

None of the three publishers was compromised or involved; the attackers took names already established in Microsoft's VS Code Marketplace that had not yet been claimed on Open VSX ^[10]. That is the reusable part of the campaign, and it is not scarce. Socket engineer John Tuckner counted 491 Open VSX IDs claimed by attackers and researchers over the previous year in a July 31 post, 338 of them in 2026 ^[12], which puts roughly 69 percent of the total in that single bucket ^[16]. A blocklist that cannot hold two facts about one name will keep having to pick which one to keep.