GlassWorm Expands Through Malicious Open VSX Extensions

Summary

Researchers identified at least 72 additional malicious Open VSX extensions linked to GlassWorm, including transitive delivery via extensionPack and extensionDependencies. The loader retains Solana memo dead drops and adds RC4/base64 obfuscation and header-based keys.

Key points

Researchers identified at least 72 additional malicious Open VSX extensions beginning January 31, 2026.
GlassWorm uses extensionPack and extensionDependencies to make extensions install other, potentially malicious extensions, including through later updates.
Many extensions impersonated popular developer tools; some showed inflated download counts, and one used a typosquatted ESLint publisher name.
The loader retains staged JavaScript execution, Russian locale and timezone geofencing, Solana transaction memo dead drops, and in-memory follow-on execution.
The campaign added RC4, base64, and string-array obfuscation, and moved decryption keys into HTTP response headers.
Researchers reported rotated Solana wallet infrastructure and additional command-and-control IP addresses.
Open VSX had removed many malicious listings by March 13, 2026, but some were still active at the time of analysis.

Article Details

Attack Vectors: Malicious Open VSX extensions use extensionPack and extensionDependencies to install other extensions transitively, including through dependencies added in later updates.
Many extensions impersonate popular developer tools; one uses a typosquatted publisher name, and some reported download counts were likely manipulated to appear legitimate.
The GlassWorm loader uses staged JavaScript, Russian locale and timezone geofencing, Solana transaction memos as dead drops, and in-memory follow-on code execution.
Loader obfuscation includes RC4, base64, and string arrays; decryption keys are delivered in HTTP response headers named ivbase64 and secretkey.
Defensive Notes: Review extensionPack and extensionDependencies relationships, including changes introduced in later extension updates, rather than examining only the initial release.
Treat extensions impersonating established developer tools, typosquatted publishers, and inflated download counts as review signals.
Open VSX had removed many malicious listings by March 13, 2026, but some transitively malicious extensions were still active at the time of analysis.

Indicators of compromise

Type	Indicator	Context
IPV4	`45[.]32[.]150[.]251`	Previously used GlassWorm command-and-control IP address that the campaign continues to reuse.
IPV4	`45[.]32[.]151[.]157`	IP address identified in the article as command-and-control infrastructure for GlassWorm.
IPV4	`70[.]34[.]242[.]255`	IP address identified in the article as command-and-control infrastructure for GlassWorm.