open-vsx

GitHub Is Becoming a Minefield for Developers. Most of Them Have No Idea.

John Z Black Mar 28, 2026

Threat Intelligence #github #supply-chain #developers #vscode #open-vsx #fake-stars #malware #devsecops

Three simultaneous attacks on GitHub's trust signals -- fake stars, weaponized security alerts, and a scanning bug that let 72 malicious extensions slip through -- show the reputation infrastructure developers rely on is broken.