GlassWorm Campaign Links Malicious GitHub Repositories, npm Packages and VS Code Extensions

Mar 16, 2026 · Original article ↗

Summary

OpenSourceMalware links GlassWorm activity across GitHub, npm, VS Code and Python through shared Solana and server infrastructure, describing its obfuscation, Node.js infostealer and indicators. The Python campaign was still active on March 14, 2026.

Key points

The analysis connects reports from Aikido, Socket and Step Security through a shared Solana address and overlapping IP infrastructure; the authors assess the activity as one coordinated campaign.
The reports cover more than 433 repositories, packages and extensions across GitHub, npm, VS Code and Python; the article says the Python campaign remained active on March 14, 2026.
JavaScript payloads in npm, GitHub and VS Code use invisible Unicode characters; Python payloads use base64, zlib and XOR obfuscation.
The article describes Python GitHub account takeovers followed by force-pushes that append malicious code while preserving the original commit message and author.
Across platforms, the payload queries Solana for command-and-control links, downloads Node.js and runs a JavaScript infostealer targeting browser cryptocurrency wallets, credentials, SSH keys and session tokens.
The malware reportedly avoids Russian-language systems. The authors describe the campaign as probably Russian in origin, while distinguishing it from DPRK-linked campaigns they track.
The article recommends checking repositories for its listed indicators, reviewing Git history and installed extensions, and checking for unexpected persistence files and Node.js installations.

Article Details

Attack Vectors: Compromised GitHub repositories were force-pushed with malicious Python code after attackers took over developer accounts.
Malicious npm packages and VSCode/Open-VSX extensions delivered JavaScript obfuscated with invisible Unicode variation selectors.
Python payloads used a base64, zlib, and XOR deobfuscation chain before executing the decoded code.
The payloads queried a Solana address for C2 updates, then downloaded a Node.js-based infostealer from IP-hosted URLs.
The infostealer targeted browser cryptocurrency wallet extensions, stored credentials, SSH keys, and session tokens.
Defensive Notes: Search Python repositories for the marker variable lzcdrtfxyqiplpd and code for the Unicode decoder fingerprint or invisible variation-selector characters.
Review Git history and reflogs for force-push tampering and commits with committer email or identity shown as "null".
Audit VSCode extensions installed from October 2025 through March 2026 and remove suspicious extensions.
Check for unexpected ~/init.json persistence and unexpected Node.js installations.
Treat the Python campaign as ongoing according to the article's March 14, 2026 reporting.

Indicators of compromise

Type	Indicator	Context
IPV4	`140[.]82[.]60[.]183`	IP identified in the article's npm-campaign infrastructure list.
IPV4	`149[.]28[.]24[.]100`	IP identified in the article's npm-campaign infrastructure list.
IPV4	`155[.]138[.]237[.]76`	IP identified in the article's npm-campaign infrastructure list.
IPV4	`207[.]246[.]77[.]75`	IP identified in the article's npm-campaign infrastructure list.
IPV4	`217[.]69[.]0[.]159`	Shared campaign infrastructure; the article gives a specific C2 payload URL on this IP.
IPV4	`217[.]69[.]10[.]135`	IP identified in the article's npm-campaign infrastructure list.
IPV4	`217[.]69[.]11[.]57`	IP listed as Python-campaign infrastructure by Step Security.
IPV4	`217[.]69[.]11[.]99`	IP listed as Python-campaign infrastructure by Step Security.
IPV4	`45[.]32[.]150[.]251`	IP referenced in Socket's report on the malicious VSCode extensions.
IPV4	`45[.]32[.]150[.]97`	IP listed as Python-campaign infrastructure by Step Security.
IPV4	`45[.]32[.]151[.]157`	Shared C2 server referenced across the npm, Python, and VSCode campaign reports.
IPV4	`45[.]76[.]44[.]240`	IP listed as Python-campaign infrastructure by Step Security.
IPV4	`66[.]42[.]56[.]190`	IP identified in the article's npm-campaign infrastructure list.
IPV4	`70[.]34[.]242[.]255`	IP referenced in Socket's report on the malicious VSCode extensions.
IPV4	`95[.]179[.]189[.]100`	IP identified in the article's npm-campaign infrastructure list.
URL	`hxxp[:]//217[.]69[.]0[.]159/dq1IMEteQ4AbO3daeYGXZw==`	Specific C2 payload URL published in a Solana transaction memo for malware to fetch.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationJavaScript payloads were concealed with invisible Unicode variation selectors; Python payloads were encoded with base64, compressed with zlib, and XOR-decrypted.T1059.006 · PythonPython repository payloads decoded and executed malicious Python code with exec(compile(...)).T1059.007 · JavaScriptThe npm and extension payloads used JavaScript, including eval to execute decoded code and a Node.js infostealer.T1078 · Valid AccountsThe reported repository-compromise method involved taking over developer GitHub accounts before force-pushing altered commits.T1105 · Ingress Tool TransferThe malware downloaded Node.js and fetched later payloads from IP-hosted URLs obtained through C2 updates.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign compromised repositories, npm packages, and editor extensions to distribute malware through software supply chains.T1552.004 · Private KeysThe infostealer targeted SSH keys on infected systems.T1555.003 · Credentials from Web BrowsersThe infostealer targeted stored credentials and browser cryptocurrency wallet extensions.

Malware

GlassWormseparate creatures. In the malware universe, a "four arms, one monster" situation has occurred with Glassworm. Several vendors identified parts of the monster, but the OpenSourceMalware team is the one that

Products

GitHubOn March 13-14, vendors released three separate reports about malware affecting npm packages, GitHub repos, VSCode extensions, and Python code.Node.jsencoding a complete malware payload. Your eyes can't see it. Most code review tools can't see it. But Node.js executes it.npmOn March 13-14, vendors released three separate reports about malware affecting npm packages, GitHub repos, VSCode extensions, and Python code.Open-VSXSocket linked 72 malicious VSCode extensions in the Open-VSX marketplace to a "GlassWorm campaign."VS CodeFrom Socket (VS Code extensions):