Loading story…
GlassWorm expanded its software supply-chain campaign in the Open VSX ecosystem by publishing dozens of seemingly benign extensions that later pull in malicious components through the extensionPack and extensionDependencies manifest fields. Socket reported 73 malicious Open VSX extensions linked to the operation, while another report cited 72 newly identified packages, reflecting the same campaign and detection set. The technique allows attackers to establish trust with an initial standalone-looking extension and then, in a later update, silently install a hidden GlassWorm loader as a transitive dependency, defeating one-time review of the original package. The malicious listings impersonate common developer tools including formatters, linters, language support packages, and AI coding assistants to maximize installation volume.
The campaign preserves earlier GlassWorm tradecraft while improving evasion and resilience. Reported behaviors include staged JavaScript execution, Russian locale/timezone geofencing, use of Solana transaction memos as dead drops, and in-memory execution of follow-on code. Socket also observed infrastructure and loader changes, including reuse of 45[.]32[.]150[.]251, addition of 45[.]32[.]151[.]157 and 70[.]34[.]242[.]255, migration to a new Solana wallet, and a shift from a static AES-wrapped loader to heavier RC4/base64/string-array obfuscation with decryption material moved into HTTP response headers such as ivbase64 and secretkey. This is a substantive threat-intelligence and vulnerability-exposure story, not fluff, because it documents an active malicious campaign, specific delivery mechanisms, and concrete infrastructure tied to developer-targeted compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
After Socket reported the newly weaponized extensions, the Eclipse Foundation removed some malicious extensions and associated publisher accounts. However, several extensions published on March 18 remained live at the time of publication, showing remediation was still ongoing.
On March 17–18, 2026, previously benign-looking Open VSX extensions were converted into extension packs or direct droppers that installed malicious VSIX payloads from GitHub. This marked a shift from relying only on Open VSX-hosted dependencies to using GitHub-hosted payload delivery and enabled arbitrary code execution across multiple editors.
Subsequent reporting said Socket later connected more than 20 additional Open VSX extensions to the same GlassWorm activity beyond the initial 72. The added findings showed the campaign had expanded further across the ecosystem.
By March 13, 2026, Open VSX had removed most of the malicious transitive extensions identified by researchers, though some packages remained available. This indicated remediation was underway but incomplete.
On March 13, 2026, Socket reported that GlassWorm had evolved its Open VSX campaign by abusing extension manifest dependency fields to hide malware in later updates. The report described staged JavaScript execution, Russian geofencing, Solana memo dead drops, in-memory execution, stronger obfuscation, and rotating infrastructure.
Aikido linked the broader operation to intrusions affecting 151 GitHub repositories and two npm packages, where invisible Unicode-based payloads were inserted while commits were disguised as routine maintenance. The activity was reported as occurring from March 3 through March 9, 2026.
Since January 31, researchers identified at least 72 malicious Open VSX extensions linked to GlassWorm. The campaign abused the extensionPack and extensionDependencies manifest fields so trusted-looking extensions could later pull in malicious components transitively.
Researchers said the Open VSX portion of the GlassWorm campaign had been active since late January 2026, using spoofed extensions that initially appeared benign. Attackers later weaponized updates to turn them into malware delivery vehicles targeting developer environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
socket.dev
Open sourcescworld.com
Open sourcecsoonline.com
Open sourcedarkreading.com
Open sourceinfoworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesocket.dev
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**GlassWorm** conducted a renewed software supply-chain campaign that compromised open-source components across **GitHub, npm, VSCode, and OpenVSX**, with researchers attributing at least **433 malicious repositories, packages, and extensions** to the operation. Reporting from multiple security firms linked the activity through shared infrastructure, similar payloads, and the same **Solana blockchain address** used for command-and-control. The campaign reportedly began with compromised GitHub accounts and force-pushed malicious commits, then expanded into published npm packages and editor extensions containing obfuscated code designed to evade review and steal developer credentials, cryptocurrency wallet data, and other sensitive information. One documented part of the campaign involved the backdooring of the npm packages **`react-native-country-select@0.3.91`** and **`react-native-international-phone-number@0.11.8`**, both published by **AstrOOnauta** and together downloaded more than **134,000** times in the prior month. Aikido found both packages used a new **`preinstall`** hook to execute an obfuscated **`install.js`** loader during a routine `npm install`, allowing infection of developer workstations, CI runners, and build agents without additional user action. Researchers said the loader was byte-identical in both packages, indicating deliberate tampering rather than a build error, and placed the incident within GlassWorm's broader pattern of using stealthy package modifications and cross-platform malware delivery to target the software development ecosystem.
Jun 30, 2026
The **GlassWorm** campaign is compromising open-source software supply chains by using stolen developer credentials and stealthy code injection techniques to backdoor repositories, packages, and extensions on **GitHub**, **npm**, **PyPI**, and the **VS Code Marketplace**. Reporting describes attackers inserting obfuscated payloads into legitimate projects, including popular repositories and Python codebases, then hiding the malicious logic with tactics such as invisible **Unicode PUA** characters, Base64 encoding, and history rewriting that preserves original commit metadata. The malware is designed to steal secrets, credentials, and access tokens, and in some cases retrieves follow-on payload information through **Solana** transaction memo fields to make exfiltration and command delivery harder to detect. The campaign appears broad and operationally mature, with one report citing at least **151 compromised GitHub repositories** in early March and another describing hundreds of affected Python repositories targeted through force-pushed malicious commits. Attackers reportedly append payloads to files such as `setup.py`, `main.py`, and `app.py`, while earlier access is linked to compromised developer environments, including malicious **VS Code** and **Cursor** extensions used to steal GitHub tokens. The activity affects multiple ecosystems and developer workflows, indicating a sustained supply-chain threat rather than isolated repository tampering, with risks extending to downstream users who install or execute code from infected projects.
Jun 29, 2026
The GlassWorm malware campaign has resurfaced with a third wave of attacks, distributing 24 malicious extensions across the Microsoft Visual Studio Marketplace and Open VSX repositories. These extensions impersonate popular developer tools and frameworks such as Flutter, React, Tailwind, Vim, and Vue, aiming to compromise developer environments. Once installed, the malware attempts to steal credentials for GitHub, npm, and OpenVSX accounts, as well as cryptocurrency wallet data, and can turn infected machines into attacker-controlled nodes for further criminal activity. The attackers have also been observed artificially inflating download counts to increase the visibility and perceived trustworthiness of their malicious extensions. GlassWorm employs advanced evasion techniques, including the use of invisible Unicode characters to hide malicious code and the deployment of a SOCKS proxy and HVNC client for stealthy remote access. Despite previous efforts by Microsoft and Open VSX to remove infected packages and rotate compromised access tokens, the threat actors have continued to return with new publisher accounts and updated extensions. The campaign highlights the ongoing risks in the software supply chain, particularly for developers relying on third-party extensions from public repositories.
Jun 29, 2026