Threat actors are publishing malicious extensions to the Open VSX marketplace, a widely used alternative to Microsoft’s official VS Code Extension Marketplace, as part of a campaign tracked as GlassWorm. The extensions carry self-propagating malware that, once installed on a developer workstation, can spread through CI/CD pipelines and into production systems and container images. Organizations with active software development teams using Open VSX face meaningful supply chain risk, including potential compromise of build artifacts and downstream customer-facing systems.