GlassWorm Campaign Uses Open VSX Dependencies to Spread Malicious Extensions
Summary
Researchers say GlassWorm abused Open VSX dependencies to deliver malicious extensions. Related reports describe Unicode-hidden payloads in GitHub and npm and 88 npm packages using remote dependencies; Endor Labs disputed claims they were legitimate research.
Key points
- Socket identified at least 72 additional malicious Open VSX extensions since January 31, 2026; the article says Open VSX took steps to remove them.
- Attackers abused extensionPack and extensionDependencies so an initially benign-looking extension could later install a GlassWorm-linked extension.
- The extensions use heavier obfuscation, rotating Solana wallets for C2 resilience, and checks to avoid infecting systems with a Russian locale.
- Aikido estimated that 151 GitHub repositories were affected from March 3–9, 2026, and found the same invisible-Unicode technique in two npm packages.
- Endor Labs reported 88 npm packages using Remote Dynamic Dependencies, which can let operators change remotely hosted payloads without publishing a new package version.
- Endor Labs said some packages collected environment variables, CI/CD tokens, and system metadata. It disputed the claim that the packages were a legitimate research experiment; some payloads had been replaced with “Hello, world!” by March 12, 2026.
Article Details
- Event Type
- Multi-platform software supply-chain campaign using malicious Open VSX extensions, GitHub repository injections, and npm packages.
- Impact
- The activity targets developers and is reported to steal tokens, credentials, secrets, environment variables, and system metadata. Socket identified at least 72 malicious Open VSX extensions; Aikido estimated 151 affected GitHub repositories between March 3 and March 9, 2026; and Endor Labs identified 88 npm packages. The article also reports use of Solana transactions for C2 resolution and rotating wallets. Open VSX took steps to remove the listed extensions. Endor Labs said the npm package owner changed some data-harvesting payloads to “Hello, world!” by March 12, 2026; it challenged the claim that the packages were part of a legitimate research experiment.
MITRE ATT&CK
T1105 · Ingress Tool TransferAikido reported that injected repository content decoded to a loader that fetched and executed a second-stage script.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign used malicious extensions and dependencies to deliver payloads through software development tools and package ecosystems.
People
Malware
Products
GitHubSocket and other analysts found dozens of malicious Open VSX extensions and linked techniques—including invisible Unicode obfuscation and Solana-based C2s—spreading across GitHub and npm.Microsoft Visual Studio MarketplaceGlassWorm is the name given to an ongoing malware campaign that has repeatedly infiltrated Microsoft Visual Studio Marketplace and Open VSX with malicious extensions designed to steal secrets and drain cryptocurrencynpmSocket and other analysts found dozens of malicious Open VSX extensions and linked techniques—including invisible Unicode obfuscation and Solana-based C2s—spreading across GitHub and npm.Open VSXResearchers warn a new GlassWorm campaign has escalated by abusing Open VSX extensionPack and extensionDependencies to turn benign-looking extensions into transitive delivery vehicles that deploy malicious payloadsVS CodeThis also opens up new supply chain attack scenarios as an attacker first uploads a completely harmless VS Code extension to the marketplace to bypass review, after which it’s updated to list a GlassWorm-linked package