GlassWorm VS Code Extension Supply Chain Attack - Open VSX Hijack
GlassWorm VS Code Extension Supply Chain Attack (TL-2026-0024), also tracked as GlassWorm, is a high-severity supply-chain compromise scored CVSS 8.1, first published 2026-02-02. It is attributed to GlassWorm Operators with medium confidence, affects Open VSX VS Code Extensions, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 13 detection rules and 28 indicators of compromise.
Key facts for TL-2026-0024
- Threat ID
- TL-2026-0024
- Also known as
- GlassWorm, VS Code Supply Chain, Open VSX Hijack
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- DORMANT
- Category
- SUPPLY_CHAIN
- First published
- 2026-02-02
- Last reviewed
- 2026-02-02
- Attribution
- GlassWorm Operators
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- Software Development, Technology, Open Source, DevOps, All Sectors with VS Code Users
- Target regions
- Global
- Detection rules
- 13
- Indicators of compromise
- 28
GlassWorm is a supply chain attack campaign targeting VS Code extension registries — primarily the Open VSX Registry and to a lesser extent the official VS Code Marketplace — through malicious extensions that masquerade as popular developer tools. The campaign leverages VS Code's lack of sandboxing (extensions run with full user privileges), weak identity verification ('Verified' badge only proves domain ownership), and permissive naming policies (displayName can exactly replicate popular extensions) to distribute credential stealers, reverse shells, and data exfiltration payloads to software developers. Extensions activate on install and every VS Code startup, executing attacker-controlled code via eval() from remote C2 servers. The campaign is particularly dangerous because VS Code is used by 74%+ of developers (StackOverflow survey) and extensions have access to the full file system, SSH keys, Git credentials, source code repositories, and the ability to install additional malware. GlassWorm specifically targeted the Open VSX Registry which serves as the extension marketplace for VSCodium, GitPod, Eclipse Theia, and other open-source VS Code alternatives with less rigorous review processes.
How GlassWorm VS Code Extension Supply Chain Attack works
GlassWorm represents an escalation in the IDE supply chain attack surface, combining the well-documented risks of package manager poisoning (npm/PyPI) with the uniquely dangerous permission model of VS Code extensions.
**VS Code Extension Security Model (or Lack Thereof):**
VS Code extensions run with the FULL privileges of the user that opened VS Code — there is NO sandbox. This means any extension can: - Read, write, and delete any file accessible to the user - Access SSH keys (~/.ssh/) and Git credentials (~/.gitconfig, credential helpers) - Execute arbitrary shell commands via Node.js child_process - Install additional software including ransomware, wipers, and backdoors - Access and modify source code in all open repositories - Read environment variables containing API keys and secrets - Make network connections to any endpoint - Access browser cookies and credential stores
This permission model makes VS Code extensions among the highest-impact supply chain attack vectors in the modern development ecosystem.
**The GlassWorm Campaign:**
The GlassWorm campaign deployed malicious extensions across the Open VSX Registry (open-vsx.org) and VS Code Marketplace through several attack techniques:
1. **Typosquatting:** Extensions published under names with subtle misspellings of popular extensions (e.g., 'pretier-vscode' instead of 'prettier-vscode', single-letter variations). When developers mistype extension names, they install the malicious variant.
2. **DisplayName Spoofing:** VS Code Marketplace and Open VSX allow arbitrary values in the 'displayName' field without uniqueness requirements. GlassWorm extensions used identical display names and icons to popular extensions (Prettier, Python, Jupyter), making them visually indistinguishable from legitimate versions.
3. **Verified Badge Abuse:** The VS Code Marketplace 'Verified' badge only confirms domain ownership — not publisher identity. GlassWorm operators registered cheap domains to obtain verified status, then changed their displayName to match popular publishers, creating convincing impersonation.
4. **Open VSX Targeting:** The Open VSX Registry (used by VSCodium, GitPod, Eclipse Theia, and other open-source VS Code alternatives) has less rigorous review processes than the Microsoft Marketplace. GlassWorm specifically targeted Open VSX as an easier ingress point for malicious extensions.
5. **Remote Code Execution via C2:** Malicious extensions included an activate() function that executed on installation and every VS Code startup. This function called out to attacker-controlled URLs (using hostname-specific subdomains for tracking: http://$HOSTNAME.attacker.com/vscode) and executed the response via eval(). This enabled: - Dynamic payload delivery (attacker changes server response to update malware) - Hostname-based targeting (deliver different payloads to different victims) - Anti-analysis evasion (benign response to researchers, malicious to targets)
6. **Credential Harvesting:** Extensions harvested: - SSH private keys from ~/.ssh/ - Git credentials from credential helpers and .gitconfig - Environment variables containing AWS_ACCESS_KEY_ID, GITHUB_TOKEN, NPM_TOKEN - Browser cookies and stored passwords - VS Code settings containing API keys and service tokens
**Aqua Nautilus Research Context:**
Aqua Nautilus researchers demonstrated the viability of this attack vector by uploading a POC extension masquerading as Prettier (one of the top 10 most installed extensions with 27M+ installations). Within 48 hours, their POC received over 1,000 installations from active developers worldwide — demonstrating the scale of potential impact.
Aqua's research also identified existing suspicious extensions in the Marketplace, including 'API Generator Plugin' and 'code-tester', which contained code that contacted external C2 servers and executed responses via eval() every 30 seconds over unencrypted HTTP.
**Impact on Software Supply Chain:**
GlassWorm-compromised developers become vectors for downstream supply chain attacks: - Stolen SSH keys enable direct commits to any repository the developer has access to - Stolen NPM/PyPI tokens enable malicious package publication - Modified source code on developer machines propagates to production - Stolen cloud credentials (AWS, GCP, Azure) enable infrastructure compromise - Lateral movement through Git organizations and CI/CD pipelines
This creates a cascading supply chain effect: compromise one developer → access all their repositories → inject malicious code → distribute to thousands of downstream consumers.
MITRE ATT&CK techniques used in TL-2026-0024
collection
T1005 Data from Local System; T1213 Data from Information Repositories
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol
discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
privilege-escalation
T1546 Event Triggered Execution
persistence
Affected products and versions in GlassWorm VS Code Extension Supply Chain Attack
- Open VSX — VS Code Extensions
Vulnerable versions: Four compromised extensions (names pending disclosure)
Fixed in: Removed from registry
Remediation for GlassWorm VS Code Extension Supply Chain Attack
Immediate actions
- Audit installed VS Code extensions against known-good list
- Remove any recently updated extensions from Open VSX pending verification
- Check for indicators of GlassWorm execution
- Review VS Code extension directory for suspicious files
Workarounds
- Disable auto-update for extensions
- Review extension changes before updating
- Run VS Code in container or sandbox for untrusted code
Longer-term hardening
- Implement extension allowlisting in enterprise environments
- Use VS Code's built-in extension verification features
- Monitor for unusual VS Code process behavior
- Consider using official Microsoft marketplace over Open VSX for critical environments
Weaknesses (CWE) in GlassWorm VS Code Extension Supply Chain Attack
CWE-829, CWE-494
Timeline of GlassWorm VS Code Extension Supply Chain Attack
- StackOverflow Developer Survey confirms VS Code as the dominant IDE with 74.48% developer usage. Over 40,000 extensions in the VS Code Marketplace with top extensions exceeding 50M installations. Source: https://survey.stackoverflow.co/2022/#section-most-popular-technologies-integrated-development-environment
- Aqua Nautilus publishes research on VS Code extension security: demonstrates typosquatting, displayName spoofing, and verified badge abuse. POC Prettier impersonation extension gets 1,000+ installs in 48 hours. Discovers existing suspicious extensions ('code-tester') with C2 callbacks via eval(). Source: https://www.aquasec.com/blog/can-you-trust-your-vscode-extensions/
- GlassWorm campaign identified targeting Open VSX Registry specifically — exploiting less rigorous review processes compared to Microsoft Marketplace. Malicious extensions distributed to VSCodium, GitPod, Eclipse Theia, and other open-source VS Code alternative users.
- Security researchers document the full GlassWorm campaign: credential stealers, reverse shells, and C2 beacon extensions deployed across both Open VSX and VS Code Marketplace. Dynamic payload delivery via eval() with hostname-specific tracking subdomains enables targeted exploitation.
- Impact assessment reveals cascading supply chain effect: compromised developer SSH keys used to inject malicious code into upstream repositories, stolen NPM/PyPI tokens used to publish malicious packages. Single developer compromise → thousands of downstream consumers affected.
- Microsoft and Open VSX implement enhanced review processes. VS Code Workspace Trust feature restricts extension capabilities in untrusted workspaces. Enterprise extension allowlists recommended as primary defense. However, fundamental issue — no extension sandbox — remains unresolved.
- As of 2026-05-29, GlassWorm's self-propagating Open VSX/npm/GitHub worm was operationally disrupted on 2026-05-26 by CrowdStrike, Google and Shadowserver, who sinkholed all four C2 channels (Solana, BitTorrent DHT, Google Calendar, VPS) to 164.92.88.210. The likely Russia-based operators remain at large with proven ability to rebuild, so it is dormant rather than fully resolved (CrowdStrike, BleepingComputer, The Hacker News).
Sources cited for GlassWorm VS Code Extension Supply Chain Attack
Threats related to GlassWorm VS Code Extension Supply Chain Attack
Detection coverage for TL-2026-0024
As of 2026-02-02, Threadlinqs Intelligence publishes 13 detection rule(s) for TL-2026-0024 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.