�� Open VSX flaw let attackers publish malicious VS Code extensions by bypassing scans.

Single boolean bug treated scan failures as “nothing to scan,” so extensions passed under load and went live.

�� How scan failures were misread and checks skipped → https://thehackernews.com/2026/03/open-vsx-bug-let-malicious-vs-code.html