GlassWorm Supply-Chain Campaign Abuses Open VSX Extension Dependencies

GlassWorm expanded its software supply-chain campaign in the Open VSX ecosystem by publishing dozens of seemingly benign extensions that later pull in malicious components through the extensionPack and extensionDependencies manifest fields. Socket reported 73 malicious Open VSX extensions linked to the operation, while another report cited 72 newly identified packages, reflecting the same campaign and detection set. The technique allows attackers to establish trust with an initial standalone-looking extension and then, in a later update, silently install a hidden GlassWorm loader as a transitive dependency, defeating one-time review of the original package. The malicious listings impersonate common developer tools including formatters, linters, language support packages, and AI coding assistants to maximize installation volume.

The campaign preserves earlier GlassWorm tradecraft while improving evasion and resilience. Reported behaviors include staged JavaScript execution, Russian locale/timezone geofencing, use of Solana transaction memos as dead drops, and in-memory execution of follow-on code. Socket also observed infrastructure and loader changes, including reuse of 45[.]32[.]150[.]251, addition of 45[.]32[.]151[.]157 and 70[.]34[.]242[.]255, migration to a new Solana wallet, and a shift from a static AES-wrapped loader to heavier RC4/base64/string-array obfuscation with decryption material moved into HTTP response headers such as ivbase64 and secretkey. This is a substantive threat-intelligence and vulnerability-exposure story, not fluff, because it documents an active malicious campaign, specific delivery mechanisms, and concrete infrastructure tied to developer-targeted compromise.