GlassWorm Returns With 73 Suspicious OpenVSX Extensions

Summary

Researchers say 73 OpenVSX extensions are part of a new GlassWorm wave; six have activated to deliver malware. Developers who installed them are advised to rotate secrets and clean their environments.

Key points

Socket reports that 73 extensions cloned from legitimate OpenVSX listings are designed to remain benign initially and deliver malicious payloads after updates.
Six extensions have activated to deliver malware; researchers assess the others as dormant or suspicious.
The extensions act as loaders, including by fetching secondary VSIX packages from GitHub, loading platform-specific .node modules, or running obfuscated JavaScript.
Socket did not provide technical details about the latest payload. Earlier GlassWorm activity targeted cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data.
Socket published a list of the 73 extensions and advises developers who installed any of them to rotate secrets and clean their development environments.

Article Details

Event Type: Supply-chain malware campaign involving 73 dormant OpenVSX extensions that later deliver malicious payloads.
Impact: Researchers report that six extensions have activated and deliver malware; the remaining extensions are assessed as suspicious or dormant. The article says earlier GlassWorm attacks targeted cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data, but Socket did not provide technical details about the newest payload. Developers who installed affected extensions are advised to rotate secrets and clean their environments.

MITRE ATT&CK

T1059.007 · JavaScriptSome variants use obfuscated JavaScript that decodes at runtime to fetch and install malicious extensions.T1105 · Ingress Tool TransferThe extensions reportedly retrieve secondary VSIX packages or other payloads at runtime.

Malware

GlassWormA new wave of the GlassWorm campaign is targeting the OpenVSX ecosystem with 73 “sleeper” extensions that are benign at upload but later deliver malicious payloads.

Products

GitHubLoader techniques include fetching secondary VSIX packages from GitHub, loading platform-specific .node modules, and using heavily obfuscated JavaScript that decodes at runtime.npmIt has since expanded across multiple ecosystems, including GitHub repositories, npm packages, and both the Visual Studio Code Marketplace and OpenVSX.OpenVSXA new wave of the GlassWorm campaign is targeting the OpenVSX ecosystem with 73 “sleeper” extensions that are benign at upload but later deliver malicious payloads.Visual Studio Code MarketplaceIt has since expanded across multiple ecosystems, including GitHub repositories, npm packages, and both the Visual Studio Code Marketplace and OpenVSX.