Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks

Cybersecurity researchers disclosed a patched vulnerability in Open VSX's pre-publish scanning pipeline ("Open Sesame") where a single-boolean return value caused scanner job failures to be treated as "nothing to scan", allowing malicious VS Code extensions to bypass vetting and be published. An attacker could trigger this by flooding the publish endpoint to exhaust the database connection pool; the issue was responsibly disclosed and addressed in Open VSX v0.32.0.