Open VSX Supply Chain Attack: How a Compromised Dev Account Spread GlassWorm Malware to 22,000+ Users

In February 2026, attackers compromised a legitimate developer account on Open VSX to push malicious extension updates carrying the sophisticated GlassWorm malware. This post breaks down the attack chain, maps it to MITRE ATT&CK, and provides actionable defense steps for developers and security teams.