GlassWorm operators deployed 72 malicious Open VSX extensions to target developers. Researchers found 151 infected GitHub repositories and say attackers abused extensionPack and extensionDependencies to make trusted extensions pull malicious payloads.
Part of the PlainSec briefing for 2026-03-15