A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 "sleeper" extensions that turn malicious after an update. [...]
GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions
Summary + source link. No paywalls, no tracking.