It says it is, but the reality is a little blurry.
Open VSX bug misread scanner failures as clean results, letting malicious VS Code extensions go live before patch in v0.32.0.