GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies

Key facts for GlassWorm Open VSX campaign

Detection coverage for GlassWorm Open VSX campaign

As of 2026-03-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0224 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GlassWorm Post-Exploitation — Developer Credential and Token File Access by Node.js Process

Detects Node.js or VS Code processes accessing sensitive developer credential files (.npmrc, .git-credentials, .env, GitHub CLI hosts.yml, AWS credentials). GlassWorm's post-exploitation payload harvests npm tokens, GitHub PATs, Git configuration, VS Code session tokens, environment variables, and SSH keys from developer workstations. This detection targets the credential harvesting phase where the in-memory payload enumerates and reads these files.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1552.001, T1528, T1005
• Data sources: sysmon, microsoft_defender_for_endpoint, file_access_logs
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(Image, "(?i)(node|Code|code-insiders|codium|cursor)\.exe$")
| where match(CommandLine, "(?i)(\.npmrc|\.git-credentials|\.gitconfig|\.env|hosts\.yml|credentials|login\.keychain)")
| eval cred_type=case(
    match(CommandLine, "(?i)\.npmrc"), "npm_token",
    match(CommandLine, "(?i)\.git-credentials"), "git_credentials",
    match(CommandLine, "(?i)\.env"), "env_secrets",
    match(CommandLine, "(?i)hosts\.yml"), "github_cli_token",
    match(CommandLine, "(?i)credentials"), "aws_credentials",
    match(CommandLine, "(?i)keychain"), "macos_keychain",
    1=1, "unknown"
)
| stats count values(cred_type) AS targeted_credentials by _time, Computer, User, Image, ParentImage
| where count >= 2
| table _time, Computer, User, Image, ParentImage, count, targeted_credentials

Microsoft KQL

union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "Code.exe", "code-insiders.exe", "codium.exe", "cursor.exe")
    or FileName in~ ("node.exe", "Code.exe")
| where FolderPath matches regex @"(?i)(\.npmrc|\.git-credentials|\.gitconfig|\.env$|hosts\.yml|aws[/\\]credentials|login\.keychain)"
    or ProcessCommandLine matches regex @"(?i)(\.npmrc|\.git-credentials|\.gitconfig|\.env|\.ssh[/\\]id_rsa)"
| extend CredentialType = case(
    FolderPath has ".npmrc" or ProcessCommandLine has ".npmrc", "npm_token",
    FolderPath has ".git-credentials" or ProcessCommandLine has ".git-credentials", "git_credentials",
    FolderPath has ".env" or ProcessCommandLine has ".env", "env_secrets",
    FolderPath has "hosts.yml", "github_cli_token",
    FolderPath has "aws" and FolderPath has "credentials", "aws_credentials",
    FolderPath has "keychain", "macos_keychain",
    "other"
)
| summarize CredentialTypes = make_set(CredentialType), AccessCount = count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, bin(Timestamp, 10m)
| where AccessCount >= 2
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, AccessCount, CredentialTypes

Sigma

title: GlassWorm Post-Exploitation — Developer Credential and Token File Access by Node.js Process
id: a1b2c3d4-2001-4a5b-8c7d-e9f0a1b2c304
status: experimental
description: Detects Node.js or VS Code processes accessing multiple developer credential files (.npmrc, .git-credentials, .env, hosts.yml) within a short window — characteristic of GlassWorm credential harvesting.
references:
    - https://socket.dev/blog/open-vsx-transitive-glassworm-campaign
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-03-13
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1528
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    category: file_access
detection:
    selection_process:
        Image|endswith:
            - '\node.exe'
            - '\Code.exe'
            - '\code-insiders.exe'
            - '\codium.exe'
            - '\cursor.exe'
    selection_files:
        TargetFilename|endswith:
            - '.npmrc'
            - '.git-credentials'
            - '.gitconfig'
            - '.env'
            - 'hosts.yml'
            - 'id_rsa'
    condition: selection_process and selection_files
falsepositives:
    - Legitimate VS Code extensions that manage Git configuration (e.g., GitLens)
    - npm CLI operations that read .npmrc for registry configuration
    - Development tools that parse .env files for environment setup
level: high

Known false positives:

• Legitimate VS Code extensions that manage Git configuration (e.g., GitLens)
• npm CLI operations that read .npmrc for registry configuration
• Development tools that parse .env files for environment setup

Tuning notes: Increase the threshold count from 2 to 3+ if legitimate developer tooling frequently accesses these files. Correlate with network connections to external IPs within 60 seconds of file access for higher confidence. Exclude known-good extension processes by hash or path. Add .ssh/id_rsa and macOS Keychain paths for broader coverage.

• 🔒 GlassWorm Exploitation — Obfuscated JavaScript Loader Execution from VS Code Extension Host · unlock with TL Creds
• 🔒 GlassWorm Post-Exploitation — Persistence via Registry Run Key or LaunchAgent from Extension Context · unlock with TL Creds
• 🔒 GlassWorm C2 — Solana Blockchain Dead Drop Resolution or Google Calendar Backup C2 Access · unlock with TL Creds
• 🔒 GlassWorm Exploitation — Extension Manifest Modification with Transitive Dependency Injection · unlock with TL Creds
• 🔒 GlassWorm Post-Exploitation — Russian Locale Geofencing Check by VS Code Extension Process · unlock with TL Creds
• 🔒 GlassWorm C2 — HTTP Response with Dynamic Decryption Key Headers (ivbase64/secretkey) · unlock with TL Creds
• 🔒 GlassWorm Exploitation — Suspicious VS Code Extension Mass Installation via Transitive Dependencies · unlock with TL Creds
• 🔒 GlassWorm C2 — Outbound Network Connection to Known GlassWorm Infrastructure · unlock with TL Creds

Indicators of compromise for GlassWorm Open VSX campaign

As of 2026-03-13, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-0224.

Sample indicators (3 of 27)

• IP address: 45.32.150[.]251
• URL: hxxps://calendar[.]app[.]google/M2ZCvM8ULL56PD1d6
• Email address: uhjdclolkdn[@]gmail[.]com

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How GlassWorm Open VSX campaign works

The GlassWorm supply chain campaign represents a significant escalation in developer ecosystem attacks, now leveraging transitive dependency abuse in VS Code extension manifests to achieve silent mass installation of malicious payloads. First documented in October 2025 as a self-propagating worm targeting OpenVSX, GlassWorm has evolved through multiple waves — November 2025 OpenVSX resurgence, December 2025 VSCode Marketplace expansion, January 2026 macOS-focused campaign, and now the March 2026 transitive dependency wave comprising 73 extensions.

The March 2026 wave introduces a novel delivery mechanism: abuse of the extensionPack and extensionDependencies fields in VS Code extension manifests. An extension appearing benign at publication is later updated to reference malicious extensions in these fields, causing automatic transitive installation through the editor's normal update mechanism. This amplifies reach far beyond direct installs — any developer with the parent extension receives malicious children silently.

The attack chain employs multi-stage JavaScript loaders with progressive obfuscation. Initial variants used static AES-256-CBC wrapped loaders, but current iterations have shifted to RC4/base64 encoding with string-array obfuscation. Decryption keys have migrated from embedded extension code to HTTP response headers (ivbase64, secretkey), making static analysis significantly harder. The loaders implement Russian locale and timezone geofencing, enabling selective execution and anti-analysis behavior.

Command-and-control infrastructure uses a triple-layer architecture: (1) Solana blockchain transaction memos as dead drop resolvers — the Memo program at MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr distributes C2 endpoints that cannot be taken down; (2) direct IP connections to Vultr-hosted servers; (3) Google Calendar as a backup C2 channel. Wallet rotation between BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC and 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ demonstrates active operational security.

Post-execution payloads operate entirely in memory via eval and vm.Script with full Node.js primitives exposed. Exfiltration targets include: npm tokens, GitHub credentials, Git configuration, VS Code session tokens, environment variables (.env files), macOS Keychain passwords, and 49+ cryptocurrency wallet browser extensions including Ledger Live and Trezor Suite. Stolen credentials are weaponized for self-propagation — compromising additional packages and extensions to create exponential spread.

Infrastructure analysis reveals strong continuity across all GlassWorm waves through overlapping IP reuse (45.32.150.251 persistent across campaigns), consistent Solana-based C2, shared cryptographic material, and evolving but recognizable loader architecture. The campaign operator demonstrates sophisticated tradecraft with progressive TTPs while maintaining operational infrastructure links.

MITRE ATT&CK techniques by tactic:

collection

T1005 Data from Local System

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel

initial-access

T1195 Supply Chain Compromise; T1199 Trusted Relationship

impact

T1496 Resource Hijacking

credential-access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Remediation for GlassWorm Open VSX campaign

Immediate actions

• Audit all installed VS Code extensions against the 73 known malicious extension identifiers
• Block network traffic to C2 IPs: 45.32.150.251, 45.32.151.157, 70.34.242.255, 217.69.3.218, 140.82.52.31
• Search developer workstations for staged extension.js files with Russian locale gating or RC4/base64 obfuscation patterns
• Rotate all npm tokens, GitHub personal access tokens, and Git credentials on potentially affected developer machines
• Review .env files and environment variable exposure on developer endpoints

Workarounds

• Disable automatic extension updates in VS Code settings
• Pin extension versions to known-good releases
• Use VS Code in restricted mode for untrusted workspaces
• Block Open VSX registry access if not required by organizational policy

Longer-term hardening

• Implement extension allowlisting policies for VS Code installations across the organization
• Deploy EDR with behavioral detection for eval/vm.Script execution chains in Node.js processes
• Monitor Solana blockchain addresses for new C2 endpoint distribution
• Establish CI/CD pipeline checks that audit extensionPack and extensionDependencies fields for transitive dependency chains
• Implement network monitoring for connections to Vultr IP ranges from developer workstations

Affected and fixed versions

• Eclipse Foundation — Open VSX Registry
  Vulnerable versions: All versions hosting malicious extensions
• Microsoft — Visual Studio Code
  Vulnerable versions: All versions supporting extensionPack/extensionDependencies
• Various — VS Code Compatible Editors (VSCodium, Cursor, Windsurf, etc.)
  Vulnerable versions: All versions supporting Open VSX extensions

Timeline of GlassWorm Open VSX campaign

• 2025-10-17 GlassWorm first discovered — 7 compromised OpenVSX extensions identified with 35,800 cumulative downloads using invisible Unicode obfuscation and Solana blockchain C2
• 2025-10-19 GlassWorm detected in Microsoft VSCode Marketplace (cline-ai-main.cline-ai-agent), 10 extensions still actively distributing malware
• 2025-11-06 Second wave emerges on OpenVSX — 3 new compromised extensions (ai-driven-dev, history-in-sublime-merge, transient-emacs) with stolen GitHub credentials enabling AI-generated malicious commits
• 2025-12-08 Third wave — 24 malicious extensions impersonating popular developer tools (Flutter, React, Tailwind, Vim, Vue) across both VSCode Marketplace and Open VSX
• 2026-01-15 Fourth wave targeting macOS developers exclusively — AES-256-CBC encrypted payloads with 15-minute execution delay, LaunchAgent persistence, Keychain credential harvesting
• 2026-01-31 Comprehensive GlassWorm campaign report published documenting full self-propagation mechanism, triple-layer C2 architecture, and credential harvesting capabilities
• 2026-03-13 Extensions remain live on Open VSX registry during Socket Security disclosure, ongoing takedown efforts in progress
• 2026-03-13 Socket Security documents evolution: decryption keys moved from embedded code to HTTP response headers (ivbase64, secretkey), Russian locale geofencing added as execution guardrail
• 2026-03-13 Fifth wave — 73 malicious Open VSX extensions discovered using transitive dependency abuse via extensionPack/extensionDependencies fields, RC4/base64 obfuscation replacing earlier AES, Solana wallet rotation to new addresses
• 2026-05-29 As of 2026-05-29, the GlassWorm campaign's active threat is neutralized: on May 26 CrowdStrike, Google and Shadowserver simultaneously severed all four C2 channels (Solana, BitTorrent DHT, Google Calendar, VPS), sinkholing victims so payloads can no longer be delivered. However, the operators are not confirmed defunct and showed resilient, evolving infrastructure over 15+ months, so reconstitution is plausible.

Sources cited for GlassWorm Open VSX campaign

• Rewterz - GlassWorm Malware Targets macOS via Trojanized VSCode Extensions rewterz.com · Advisory · 2026-01-15
• Socket Security - 73 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies socket.dev · Research · 2026-03-13
• Truesec - GlassWorm: Self-Propagating VSCode Extension Worm truesec.com · Research · 2025-10-19
• Fluid Attacks - GlassWorm Supply Chain Attack Analysis fluidattacks.com · Research · 2025-11-12
• Veracode - GlassWorm: The First Self-Propagating VS Code Extension Worm veracode.com · Research · 2025-10-21
• Koi Security - GlassWorm Analysis: Invisible Code Hits OpenVSX Marketplace koi.ai · Research · 2025-10-20
• BleepingComputer - Glassworm Malware Returns in Third Wave of Malicious VS Code Packages BleepingComputer · News · 2025-12-08
• SecurityWeek - GlassWorm Malware Returns to Open VSX, Emerges on GitHub SecurityWeek · News · 2025-11-10
• The Hacker News - GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools The Hacker News · News · 2025-12-08
• Security Affairs - GlassWorm Malware Has Resurfaced on the Open VSX Registry securityaffairs.com · News · 2025-11-10
• Dark Reading - GlassWorm Returns, Slices Back into VS Code Extensions Dark Reading · News · 2025-12-09
• Open Source For You - GlassWorm Malware Abuses Open Source Open VSX To Target macOS Developers opensourceforu.com · News · 2026-01-20

Threats related to GlassWorm Open VSX campaign

• GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
• GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
• GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
• GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
• TeamPCP Supply Chain Attack via Backdoored Telnyx PyPI Package with Steganographic WAV Payloads

Related coverage of this activity

• GlassWorm v2 sleeper extensions

More from GlassWorm

• OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0)
• GlassWorm macOS Attack via Compromised OpenVSX Extensions

Previous and next in supply chain

• Malicious Packagist Packages Deliver Cross-Platform PHP RAT via Fake Laravel Utilities (nhattuanbl Campaign) Previous report
• AppsFlyer Web SDK Supply Chain Hijack via Domain Registrar Compromise for Cryptocurrency Theft Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages