GlassWorm Supply-Chain Worm Hits VS Code, OpenVSX, npm, PyPI, and GitHub

GlassWorm was reported as a self-propagating supply-chain malware campaign that spread through developer ecosystems including the VS Code Marketplace, OpenVSX, npm, PyPI, and GitHub repositories. Reporting indicates the malware abused invisible Unicode characters to hide malicious logic inside extensions and packages, allowing payloads to evade casual review while embedding decoder routines, command-and-control markers, and other indicators of compromise. One wave specifically targeted macOS users through poisoned OpenVSX extensions, expanding the campaign beyond code repositories into developer workstations.

Security researchers and defenders responded by publishing detection guidance and tooling to hunt for GlassWorm artifacts across local Git repositories, VS Code extensions, and package dependencies. The open-source glassworm-hunter project was released to scan for hidden Unicode payloads, decoder patterns, C2 markers, and known malicious IOCs, reflecting concern that the campaign crossed multiple software distribution channels rather than a single marketplace. The incident highlights a broad software supply-chain intrusion in which trusted developer platforms were used to distribute stealthy malware concealed inside seemingly legitimate code.