GlassWorm Supply Chain Attack on Visual Studio Code Extensions
A sophisticated supply chain attack has targeted Visual Studio Code (VS Code) extensions, leveraging a self-propagating worm known as GlassWorm. Security researchers at Koi Security discovered the malware after identifying suspicious behavior in an extension called CodeJoy on the OpenVSX marketplace. The worm employs a novel technique using invisible Unicode characters, making the malicious code undetectable to the human eye within code editors. This approach allows the malware to evade traditional detection methods and remain stealthy within compromised extensions. GlassWorm utilizes the Solana blockchain as its primary command-and-control (C2) channel, with Google Calendar serving as a backup C2 infrastructure, enhancing its resilience and making takedown efforts more challenging. The worm has already infected nearly 36,000 developer machines, indicating a significant impact on the developer ecosystem. Once installed, GlassWorm harvests credentials from NPM, GitHub, and Git, enabling it to propagate further by compromising additional packages and extensions. The malware also targets cryptocurrency wallets, seeking to steal digital assets from affected users. Infected systems are converted into SOCKS proxy servers, effectively turning developer machines into part of the attacker's extended C2 infrastructure. Additionally, GlassWorm installs hidden virtual network computing (VNC) servers, granting attackers full remote access to compromised machines. The attack highlights the growing risks associated with open-source marketplaces and the potential for widespread compromise through popular development tools. Security experts emphasize the importance of scrutinizing extension code and implementing stronger guardrails in extension marketplaces to prevent similar attacks. The use of invisible Unicode and blockchain-based C2 channels represents a significant evolution in malware stealth and persistence. The incident underscores the need for developers and organizations to monitor for unusual extension behavior and to regularly audit installed extensions for signs of compromise. The attack also demonstrates the potential for supply chain threats to rapidly scale, given the interconnected nature of developer tools and platforms. As the investigation continues, security vendors and marketplace operators are working to identify and remove malicious extensions and to strengthen defenses against future supply chain attacks.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
GlassWorm evolves with Zig dropper and cross-IDE propagation
Researchers reported a new GlassWorm variant delivered via the malicious Open VSX extension 'specstudio.code-wakatime-activity-tracker,' which impersonated WakaTime and used a Zig-compiled binary to escape the JavaScript sandbox and spread to multiple VS Code-compatible IDEs. The campaign deployed a second-stage extension, 'floktokbok.autoimport,' used Solana-based C2, avoided Russian systems, exfiltrated data, installed a RAT, and ultimately dropped a malicious Chrome info-stealing extension; the Open VSX package was later removed.
Nine GlassWorm extensions remained live on VS Marketplace
Breakglass Intelligence reported that nine malicious GlassWorm-infected Visual Studio Code extensions were still available on the Microsoft Visual Studio Marketplace as of 2026-03-16, indicating the campaign remained exposed to developers months after its initial discovery. The report also detailed a Rust-based second stage using in-memory PE execution and published IOCs plus YARA and Suricata detections.
Scope of GlassWorm campaign tied to infected marketplace extensions
Analysis revealed that 13 extensions on Open VSX and one on the Microsoft Extension Marketplace were infected, with roughly 35,800 total downloads. Reports also described the malware's objectives as credential theft, cryptocurrency wallet draining, proxy deployment, persistence, and further propagation via stolen credentials.
Researchers uncover GlassWorm supply-chain worm in VS Code extensions
Security researchers, including Koi Security, identified and disclosed a self-propagating malware campaign dubbed GlassWorm targeting developer extension marketplaces. The worm was found to hide code with invisible Unicode characters and to use Solana blockchain infrastructure, with Google Calendar as fallback command-and-control.
First GlassWorm infections observed in VS Code extension ecosystems
The earliest known GlassWorm infections were observed affecting Visual Studio Code extensions distributed through Open VSX and later the Microsoft Extension Marketplace. The campaign used compromised developer accounts and extension auto-updates to begin spreading through trusted packages.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
10 references tracked. Mallory keeps watching after this page renders.
GlassWorm uses Zig binary to infect multiple IDEs | brief | SC Media
scworld.com
Open sourceGlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs
thehackernews.com
Open sourceGlassWorm: 9 Infected VS Code Extensions Are Still Live -- Inside the Rust-Powered Supply Chain Attack Targeting Developers - Breakglass Intelligence - Breakglass Intelligence
intel.breakglass.tech
Open sourceSelf-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack
thehackernews.com
Open sourceRisky Bulletin: Clever worm hits the DevOps scene
news.risky.biz
Open sourceSelf-Propagating GlassWorm Attacks VS Code Supply Chain
darkreading.com
Open sourceGlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2
securityonline.info
Open sourceGlassWorm goes native: New Zig dropper infects every IDE on your machine - Infosec.Pub
infosec.pub
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GlassWorm Supply Chain Attack via Malicious VS Code and Open VSX Extensions
The GlassWorm malware campaign has resurfaced with a third wave of attacks, distributing 24 malicious extensions across the Microsoft Visual Studio Marketplace and Open VSX repositories. These extensions impersonate popular developer tools and frameworks such as Flutter, React, Tailwind, Vim, and Vue, aiming to compromise developer environments. Once installed, the malware attempts to steal credentials for GitHub, npm, and OpenVSX accounts, as well as cryptocurrency wallet data, and can turn infected machines into attacker-controlled nodes for further criminal activity. The attackers have also been observed artificially inflating download counts to increase the visibility and perceived trustworthiness of their malicious extensions. GlassWorm employs advanced evasion techniques, including the use of invisible Unicode characters to hide malicious code and the deployment of a SOCKS proxy and HVNC client for stealthy remote access. Despite previous efforts by Microsoft and Open VSX to remove infected packages and rotate compromised access tokens, the threat actors have continued to return with new publisher accounts and updated extensions. The campaign highlights the ongoing risks in the software supply chain, particularly for developers relying on third-party extensions from public repositories.
Apr 29, 2026
GlassWorm Supply-Chain Worm Hits VS Code, OpenVSX, npm, PyPI, and GitHub
**GlassWorm** was reported as a self-propagating supply-chain malware campaign that spread through developer ecosystems including the **VS Code Marketplace**, **OpenVSX**, **npm**, **PyPI**, and **GitHub** repositories. Reporting indicates the malware abused **invisible Unicode characters** to hide malicious logic inside extensions and packages, allowing payloads to evade casual review while embedding decoder routines, command-and-control markers, and other indicators of compromise. One wave specifically targeted **macOS** users through poisoned OpenVSX extensions, expanding the campaign beyond code repositories into developer workstations. Security researchers and defenders responded by publishing detection guidance and tooling to hunt for GlassWorm artifacts across local Git repositories, VS Code extensions, and package dependencies. The open-source **`glassworm-hunter`** project was released to scan for hidden Unicode payloads, decoder patterns, C2 markers, and known malicious IOCs, reflecting concern that the campaign crossed multiple software distribution channels rather than a single marketplace. The incident highlights a broad software supply-chain intrusion in which trusted developer platforms were used to distribute stealthy malware concealed inside seemingly legitimate code.
May 31, 2026
GlassWorm Malware Campaign Targets macOS via Malicious VS Code Extensions
A new wave of the GlassWorm malware campaign is actively targeting macOS users by distributing trojanized Visual Studio Code (VS Code) extensions through the OpenVSX marketplace. This fourth iteration marks a significant shift from previous campaigns, which primarily targeted Windows systems, and now leverages AES-256-CBC–encrypted JavaScript payloads embedded in extensions such as `studio-velte-distributor.pro-svelte-extension`, `cudra-production.vsce-prettier-pro`, and `Puccin-development.full-access-catppuccin-pro-extension`. The malware is designed to steal credentials for platforms like GitHub, npm, and OpenVSX, as well as cryptocurrency wallet data, and it supports remote access via VNC and SOCKS proxy routing. Notably, the latest campaign employs AppleScript for execution on macOS and introduces a 15-minute delay before activating its malicious logic, a tactic intended to evade detection by automated sandbox analysis. Researchers from Koi Security identified that the threat actor behind GlassWorm has adapted its techniques over four distinct waves since October, evolving from using invisible Unicode characters and compiled Rust binaries to the current encrypted JavaScript approach. The malware's command and control infrastructure is now based on the Solana blockchain, utilizing transaction memos with base64-encoded URLs to maintain decentralized and resilient control, making takedown efforts extremely challenging. Over 50,000 downloads of the malicious extensions have been recorded, and the campaign's infrastructure has been linked to previous waves through shared IP addresses and encryption keys. The sophistication and persistence of GlassWorm highlight the growing threat to macOS developers and users who rely on third-party extension marketplaces for their development environments.
Mar 21, 2026