Socket Tracks 73 Open VSX Extensions Linked to GlassWorm, Including Six Activated to Deliver Malware
Summary
Socket reports 73 Open VSX extensions linked to GlassWorm, with at least six activated to deliver malware. The investigation describes cloned listings, dependency-based delivery, native binaries, and obfuscated JavaScript loaders.
Key points
- Socket tracks 73 impersonation or suspicious extensions; at least six have reportedly been activated to deliver malware, while the others are classified as high-confidence sleepers or suspicious.
- Cloned extension listings imitate legitimate projects to attract installs before malicious functionality is introduced.
- Some extensions use extensionPack or extensionDependencies for transitive delivery; others retrieve VSIX payloads hosted on GitHub.
- Some variants load platform-specific .node binaries containing installer logic; others use obfuscated JavaScript to retrieve and install payloads.
- The reported installer commands target VS Code, Cursor, Windsurf, and VSCodium.
- Socket says it has marked the tracked extensions on its GlassWorm v2 page while analysis continues.
Article Details
- Attack Vectors
- Impersonation extensions are published to Open VSX as benign sleeper packages, then updated to deliver malware through the normal extension update path.
- Extensions use extensionPack or extensionDependencies to install a separate malicious component through transitive delivery.
- Extensions retrieve VSIX payloads from GitHub-hosted releases.
- Platform-specific native .node binaries contain installer logic and embedded GitHub release URLs.
- Obfuscated JavaScript decodes at runtime to retrieve and install VSIX payloads.
- Downloaded extensions are installed across IDEs using CLI commands such as --install-extension.
- Earlier variants used Solana transaction memos as dead drops for runtime payload retrieval.
- Defensive Notes
- Socket marked the tracked extensions on its GlassWorm v2 page and said it was protecting tracked listings while analysis continued.
- The article warns that cloned listings can closely imitate legitimate extensions, including their names, icons, descriptions, and README content.
- The article notes that extension source code may not reveal the behavior implemented in bundled native binaries or retrieved payloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1b62b7c2ed7cc296ce821f977ef7b22bae59ef1dcdb9a34ae19467ee39bcf168 | SHA-256 hash identified in the article for a native installer binary used in the campaign. |
| SHA256 | 4ebfe8f66ca7e9751060b3301b5e8838d6017593cdae748541de83bfa28183bd | SHA-256 hash identified in the article for a native installer binary used in the campaign. |
| SHA256 | 97c275e3406ad6576529f41604ad138c5bdc4297d195bf61b049e14f6b30adfd | SHA-256 hash identified in the article for a downloaded VSIX payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSome variants use heavily obfuscated JavaScript that decodes at runtime to retrieve a VSIX payload.T1059 · Command and Scripting InterpreterExtension code resolves editor CLI paths and runs installation commands such as --install-extension for downloaded payloads.T1105 · Ingress Tool TransferExtensions retrieve additional VSIX payloads from GitHub-hosted releases.T1195 · Supply Chain CompromiseThe article describes impostor Open VSX extensions published as sleepers and later weaponized through updates or extension dependencies.T1574 · Hijack Execution FlowAn extension loads a platform-specific bundled .node native module that implements the installer logic.T1583 · Acquire InfrastructureThe extensions were published by newly created GitHub accounts with sparse repositories, including empty repositories named with eight-character strings.
Products
Cursorfiles and include installation logic (e.g., --install-extension) targeting multiple IDEs such as VS Code, Cursor, and Windsurf.Open VSXThe GlassWorm campaign has expanded on Open VSX with a new cluster of 73 impersonation extensions that were initially published as benign “sleeper” packages and later updated to deliver malware through normal extensionVS Code.vsix files and include installation logic (e.g., --install-extension) targeting multiple IDEs such as VS Code, Cursor, and Windsurf.VSCodiumThe code resolves CLI paths for multiple editors, including VS Code, Cursor, Windsurf, and VSCodium, and installs the downloaded extension using commands such as --install-extension.Windsurfinstallation logic (e.g., --install-extension) targeting multiple IDEs such as VS Code, Cursor, and Windsurf.