Open Sesame: How a Fail-Open Bug in Open VSX's New Scanner Let Malware Walk Right In
Open VSX, the open-source extension marketplace behind development environments like Cursor, Windsurf, and the broader Visual Studio Code fork ecosystem, recently introduced a pre-publish scanning pipeline. Designed as an extensible verification gate, the system executes malware detection, secret scanning, binary analysis, and name-squatting checks before an extension goes live.
