Open VSX Registry Supply-Chain Attack Spreads GlassWorm via Compromised VSCode Extensions

A supply-chain compromise of the Open VSX Registry led to malicious updates being pushed to legitimate Visual Studio Code extensions after attackers gained access to a developer’s publishing credentials (likely via a leaked token or other unauthorized access). Reporting indicates four established extensions from the oorzc publisher were trojanized and distributed via Open VSX before being removed, with prior legitimate adoption measured in the tens of thousands of downloads and subsequent exposure affecting downstream developer environments.

The injected payload delivered the GlassWorm malware/loader, which executes via obfuscated JavaScript embedded in the extension and includes environment checks (notably avoiding execution on Russian-locale systems). Technical details describe a multi-stage loader with capabilities aligned to credential and data theft, including macOS credential and cryptocurrency wallet targeting, and use of techniques such as EtherHiding to retrieve command-and-control infrastructure dynamically; defenders are advised to identify and remove affected extension versions and review developer endpoints for signs of compromise and credential/token leakage.