GlassWorm Uses Open VSX Extension Dependencies for Transitive Malware Delivery
Summary
Socket reports GlassWorm-linked Open VSX extensions using later-added extensionPack and extensionDependencies entries to install malicious extensions transitively. The campaign also rotates infrastructure and obfuscates staged JavaScript loaders, making version-history
Key points
- GlassWorm-linked extensions use extensionPack and extensionDependencies to install other extensions automatically, allowing previously benign-appearing packages to become transitive delivery vehicles after updates.
- The article reports confirmed relationships involving otoboss.autoimport-extension and GlassWorm-linked packages, and identifies twilkbilk.color-highlight-css and crotoapp.vscode-xml-extension as live examples at the time of writing.
- Open VSX had removed most identified transitively malicious extensions as of March 13, but the article says takedowns were ongoing and some examples remained live.
- The loader retains staged JavaScript, Russian locale/timezone gating, Solana transaction memo dead drops, and in-memory follow-on execution; newer variants add RC4/base64/string-array obfuscation and move decryption material into HTTP response headers.
- The campaign rotated its Solana wallet and added C2 IPs 45[.]32[.]151[.]157 and 70[.]34[.]242[.]255 while reusing 45[.]32[.]150[.]251; the article cites overlapping infrastructure as support for GlassWorm attribution.
- The researchers recommend auditing extension histories and manifest changes, reviewing transitive install chains, and blocking or removing GlassWorm-linked packages and indicators.
Article Details
- Attack Vectors
- Abuse of Open VSX extensionPack and extensionDependencies manifest fields to make extensions automatically install separate GlassWorm-linked extensions, including through changes introduced in later updates.
- Staged JavaScript loader retrieves and decodes follow-on code, then executes it in memory via eval and vm.Script.
- Russian locale/timezone gating limits execution to selected environments.
- Solana transaction memos are used as dead drops for follow-on payload retrieval.
- RC4, base64, and string-array obfuscation conceal loader logic; decryption material is supplied through HTTP response headers.
- Defensive Notes
- Audit extension histories and version-to-version manifest diffs for newly added extensionPack or extensionDependencies relationships.
- Review extension installation chains and transitive dependencies, not only the code of the initially installed extension.
- Remove or block GlassWorm-linked extensions and the listed C2 IP addresses.
- Hunt for staged extension.js loaders, Russian locale/timezone checks, Solana memo lookups, and in-memory follow-on execution.
- Review developer workstations for exposed credentials, tokens, configuration data, and environment secrets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]32[.]150[.]251 | C2 infrastructure reused by the GlassWorm campaign. |
| IPV4 | 45[.]32[.]151[.]157 | Additional C2 IP address identified for the GlassWorm campaign. |
| IPV4 | 70[.]34[.]242[.]255 | Additional C2 IP address identified for the GlassWorm campaign. |
MITRE ATT&CK
T1027.013 · Encrypted/Encoded FileThe loader uses RC4, base64, and string-array obfuscation; earlier versions used an AES-wrapped loader.T1059.007 · JavaScriptThe staged JavaScript loader retrieves follow-on code and executes it using eval and vm.Script.T1102.001 · Dead Drop ResolverSolana transaction memos are used as dead drops to retrieve follow-on payload information.T1195.001 · Compromise Software Dependencies and Development ToolsGlassWorm abuses extensionPack and extensionDependencies to deliver GlassWorm-linked extensions through software dependencies.T1204 · User ExecutionNormal extension installation or update behavior triggers automatic installation of extensions declared in a pack or dependency list.T1480 · Execution GuardrailsThe loader uses Russian locale/timezone gating to limit execution.
Threat Actors
Malware
Products
Open VSXGlassWorm has evolved to abuse Open VSX manifest relationships (extensionPack and extensionDependencies) to convert benign-appearing extensions into transitive delivery vehicles that pull GlassWorm-linked packages inVS CodeThe primary attack surface is the Open VSX / VS Code extension install-and-update path, and the highest-risk assets are developer workstations and any local credentials, tokens, configuration data, or environment
Tools
Socket AI ScannerSocket AI Scanner’s analysis of the malicious aadarkcode.one-dark-material Open VSX extension flags a staged GlassWorm-style loader in extension/out/extension.js, highlighting heavy obfuscation, runtime retrieval andSocket browser extensionThe Socket browser extension helps users spot suspicious packages while browsing, and Socket MCP reduces the chance that malicious or hallucinated packages enter projects through AI-assisted coding workflows.Socket CLIThe Socket CLI adds install-time visibility and policy enforcement for behaviors associated with GlassWorm-style loaders, including obfuscation, decrypt-and-execute logic, and unexpected network access.Socket FirewallSocket Firewall blocks known malicious packages before fetch, including transitive dependencies, which matters when a package becomes malicious only after a later update.Socket GitHub Appremove/block GlassWorm-linked packages and indicators, and use tooling (e.g., Socket GitHub App/CLI/Firewall) to detect and block transitive malicious installs.Socket MCPThe Socket browser extension helps users spot suspicious packages while browsing, and Socket MCP reduces the chance that malicious or hallucinated packages enter projects through AI-assisted coding workflows.