GlassWorm Campaign Targets 433 GitHub, npm, and VSCode/OpenVSX Components

Summary

Researchers identified 433 components targeted by a renewed GlassWorm campaign. The malware uses compromised GitHub accounts, invisible Unicode obfuscation, and Solana-based C2 to deliver an information stealer; researchers also shared checks for possible compromise.

Key points

Researchers identified 200 GitHub Python repositories, 151 GitHub JS/TS repositories, 72 VSCode/OpenVSX extensions, and 10 npm packages among 433 compromised components.
The campaign uses compromised GitHub accounts to force-push malicious commits, then publishes malicious packages and extensions with invisible Unicode obfuscation.
The malware queries the Solana blockchain for instructions, mainly to update payload URLs, and uses transaction memos to direct downloads and execution.
The delivered Node.js-based JavaScript information stealer targets cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data.
Researchers linked campaign activity through a shared Solana address, similar payloads, and shared infrastructure; the article says evidence is insufficient for confident attribution to Russia-speaking actors.
Step Security recommends checking for the marker "lzcdrtfxyqiplpd", ~/init.json, unexpected ~/node-v22* installations, suspicious i.js files, and anomalous Git commit dates.

Article Details

Event Type: GlassWorm supply-chain malware campaign compromising open-source repositories, npm packages, and VSCode/OpenVSX extensions.
Impact: Researchers identified 433 compromised components: 200 GitHub Python repositories, 151 GitHub JS/TS repositories, 72 extensions, and 10 npm packages. The malware is described as targeting cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data; the article does not confirm that this information was successfully exfiltrated.