BRUSSELS, March 03, 2026 (GLOBE NEWSWIRE) — The Eclipse Foundation today announced major security and infrastructure advancements to the Open VSX Registry as it surpasses 300 million downloads per month, underscoring its role as critical infrastructure for AI-native and cloud-based development platforms.
The Open VSX Registry is the vendor-neutral extension registry for tools built on the VS Code™ extension API. It powers a growing ecosystem of AI-enabled and cloud-based developer platforms, including Amazon’s Kiro, Google’s Antigravity, Cursor, IBM’s Bob, VSCodium, Windsurf, Ona (formerly Gitpod), and others.
With peak daily traffic exceeding 50 million requests and more than 10,000 extensions from over 6,500 publishers, Open VSX has become a critical production dependency for developer platforms serving millions of users worldwide. As adoption deepens across production workflows, major commercial adopters are contributing to efforts that strengthen Open VSX’s security, reliability, and long-term sustainability.
“Open VSX has evolved into foundational infrastructure for the global developer ecosystem,” said Mike Milinkovich, Executive Director of the Eclipse Foundation. “As adoption accelerates across AI-native and cloud-based development platforms, we are investing to ensure the registry remains secure, resilient, and vendor-neutral. Support from leading commercial adopters reinforces Open VSX as trusted, shared infrastructure.”
Industry leaders invest in sustaining shared infrastructure
At this level of usage, reliability and shared accountability are no longer optional. As AI-native IDEs and cloud development environments scale rapidly, extension distribution has become mission-critical infrastructure rather than a background service.
Amazon Web Services (AWS) has made a strategic investment to strengthen the reliability, performance, and security of open infrastructure operated by the Eclipse Foundation, including the Open VSX Registry. AWS support accelerates improvements in traffic management, malware detection, and platform resilience.
Cursor, one of the fastest-growing AI-native developer environments, is also supporting Open VSX as its extension traffic continues to grow, underscoring the registry’s role in modern development workflows.
Together, these investments reflect a broader industry shift toward shared responsibility for the sustainability of critical open source infrastructure.
Proactive supply chain protection
Sustaining trust requires both technical safeguards and operational investment. The Open VSX Registry has introduced a new pre-publication verification framework to identify security risks before extensions are published.
The framework enables the registry to:
- Detect namespace impersonation and extension name spoofing
- Flag exposed credentials or embedded secrets
- Scan for known malicious patterns
- Quarantine suspicious uploads for review prior to publication
The system is designed to evolve alongside emerging threat models. The registry is also implementing responsible rate limiting and traffic management to ensure sustainable growth and consistent availability during periods of elevated demand. Rate limiting is targeted at sustained, high-volume automated traffic. For the vast majority of developers and open source projects, normal usage will remain unchanged.
Infrastructure designed for reliability at global scale
Security alone is not enough. Platform resilience must scale alongside demand. To support continued growth, the Open VSX Registry is transitioning to a hybrid, multi-region architecture. Core services will operate in AWS in Europe as the primary production environment, with a fully operational on-premises deployment in Canada maintained as an independent secondary environment.
All registry data, backups, and telemetry remain within these regions and are encrypted in transit and at rest, reinforcing vendor-neutral extension distribution aligned with global expectations for trust and operational independence.
This architecture reduces single points of failure and strengthens resilience for the expanding ecosystem of AI-native and cloud-based development platforms that rely on the Open VSX Registry.
Open VSX will be a Platinum Sponsor and active participant at OCX 2026, the Eclipse Foundation’s flagship developer conference, April 21–23, 2026, in Brussels. Additional updates and ecosystem developments will be shared at the event. Registration for OCX is now open. Developers, contributors, and ecosystem partners are encouraged to attend sessions and join discussions shaping the future of open developer tooling and infrastructure, including the latest advances in AI-integrated developer environments.
Trusted, open infrastructure requires both institutional support and community contribution. Organisations that depend on the Open VSX Registry are encouraged to participate through sponsorship or membership, and developers are invited to contribute to the project and help shape its future.
About the Open VSX Registry
The Open VSX Registry is the open, vendor-neutral extension registry for tools built on the VS Code™ extension API. Governed transparently under the Eclipse Foundation, it provides developers, publishers, and platform builders with a trusted open alternative to proprietary extension marketplaces. Because Eclipse Open VSX is open source and self-hostable, organisations may also deploy their own internal registry implementations as needed.
About the Eclipse Foundation
The Eclipse Foundation provides a global community of individuals and organisations with a vendor-neutral, business-friendly environment for open source collaboration and innovation. We host Adoptium, the Eclipse IDE, Jakarta EE, Open VSX, Software Defined Vehicle, and more than 400 high-impact open source projects. Headquartered in Brussels, Belgium, we are an international non-profit association supported by over 300 members. Our events, including Open Community Experience (OCX), bring together developers, industry leaders, and researchers from around the world. To learn more, follow us on X and LinkedIn, or visit eclipse.org.
Media contacts:
Schwartz Public Relations (Germany)
Julia Rauch/Marita Bäumer
Sendlinger Straße 42A
80331 Munich
EclipseFoundation@schwartzpr.de
+49 (89) 211 871 -70/ -62
514 Media Ltd (France, Italy, Spain)
Benoit Simoneau
benoit@514-media.com
M: +44 (0) 7891 920 370
Nichols Communications (Global Press Contact)
Jay Nichols
jay@nicholscomm.com
+1 408-772-1551
