GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
GlassWorm Supply Chain Campaign (TL-2026-0224), also tracked as GlassWorm, is a high-severity supply-chain compromise scored CVSS 8.6, first published 2026-03-13. It is attributed to GlassWorm Operator (Russia) with medium confidence, affects Eclipse Foundation Open VSX Registry, maps to 19 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0224
- Threat ID
- TL-2026-0224
- Also known as
- GlassWorm, GlassWorm Campaign, Open VSX Transitive Supply Chain Attack
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
- Status
- DORMANT
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-13
- Last reviewed
- 2026-03-13
- Attribution
- GlassWorm Operator
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, financial, government, cryptocurrency
- Target regions
- Global, North America, Europe, Middle East
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in GlassWorm Supply Chain Campaign
Malware and tooling: RedExt C&C Platform, Solana Memo Program: MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr
The GlassWorm campaign has escalated to deliver 73 malicious VS Code extensions via the Open VSX registry, abusing extensionPack and extensionDependencies manifest fields for transitive installation of staged JavaScript loaders. The loaders employ RC4/base64 obfuscation, Russian locale geofencing, and Solana blockchain transaction memos as dead drop resolvers to exfiltrate tokens, credentials, and environment secrets from developer workstations.
How GlassWorm Supply Chain Campaign works
The GlassWorm supply chain campaign represents a significant escalation in developer ecosystem attacks, now leveraging transitive dependency abuse in VS Code extension manifests to achieve silent mass installation of malicious payloads. First documented in October 2025 as a self-propagating worm targeting OpenVSX, GlassWorm has evolved through multiple waves — November 2025 OpenVSX resurgence, December 2025 VSCode Marketplace expansion, January 2026 macOS-focused campaign, and now the March 2026 transitive dependency wave comprising 73 extensions.
The March 2026 wave introduces a novel delivery mechanism: abuse of the extensionPack and extensionDependencies fields in VS Code extension manifests. An extension appearing benign at publication is later updated to reference malicious extensions in these fields, causing automatic transitive installation through the editor's normal update mechanism. This amplifies reach far beyond direct installs — any developer with the parent extension receives malicious children silently.
The attack chain employs multi-stage JavaScript loaders with progressive obfuscation. Initial variants used static AES-256-CBC wrapped loaders, but current iterations have shifted to RC4/base64 encoding with string-array obfuscation. Decryption keys have migrated from embedded extension code to HTTP response headers (ivbase64, secretkey), making static analysis significantly harder. The loaders implement Russian locale and timezone geofencing, enabling selective execution and anti-analysis behavior.
Command-and-control infrastructure uses a triple-layer architecture: (1) Solana blockchain transaction memos as dead drop resolvers — the Memo program at MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr distributes C2 endpoints that cannot be taken down; (2) direct IP connections to Vultr-hosted servers; (3) Google Calendar as a backup C2 channel. Wallet rotation between BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC and 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ demonstrates active operational security.
Post-execution payloads operate entirely in memory via eval and vm.Script with full Node.js primitives exposed. Exfiltration targets include: npm tokens, GitHub credentials, Git configuration, VS Code session tokens, environment variables (.env files), macOS Keychain passwords, and 49+ cryptocurrency wallet browser extensions including Ledger Live and Trezor Suite. Stolen credentials are weaponized for self-propagation — compromising additional packages and extensions to create exponential spread.
Infrastructure analysis reveals strong continuity across all GlassWorm waves through overlapping IP reuse (45.32.150.251 persistent across campaigns), consistent Solana-based C2, shared cryptographic material, and evolving but recognizable loader architecture. The campaign operator demonstrates sophisticated tradecraft with progressive TTPs while maintaining operational infrastructure links.
MITRE ATT&CK techniques used in TL-2026-0224
collection
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
impact
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Affected products and versions in GlassWorm Supply Chain Campaign
- Eclipse Foundation — Open VSX Registry
Vulnerable versions: All versions hosting malicious extensions - Microsoft — Visual Studio Code
Vulnerable versions: All versions supporting extensionPack/extensionDependencies - Various — VS Code Compatible Editors (VSCodium, Cursor, Windsurf, etc.)
Vulnerable versions: All versions supporting Open VSX extensions
Remediation for GlassWorm Supply Chain Campaign
Immediate actions
- Audit all installed VS Code extensions against the 73 known malicious extension identifiers
- Block network traffic to C2 IPs: 45.32.150.251, 45.32.151.157, 70.34.242.255, 217.69.3.218, 140.82.52.31
- Search developer workstations for staged extension.js files with Russian locale gating or RC4/base64 obfuscation patterns
- Rotate all npm tokens, GitHub personal access tokens, and Git credentials on potentially affected developer machines
- Review .env files and environment variable exposure on developer endpoints
Workarounds
- Disable automatic extension updates in VS Code settings
- Pin extension versions to known-good releases
- Use VS Code in restricted mode for untrusted workspaces
- Block Open VSX registry access if not required by organizational policy
Longer-term hardening
- Implement extension allowlisting policies for VS Code installations across the organization
- Deploy EDR with behavioral detection for eval/vm.Script execution chains in Node.js processes
- Monitor Solana blockchain addresses for new C2 endpoint distribution
- Establish CI/CD pipeline checks that audit extensionPack and extensionDependencies fields for transitive dependency chains
- Implement network monitoring for connections to Vultr IP ranges from developer workstations
Weaknesses (CWE) in GlassWorm Supply Chain Campaign
CWE-506, CWE-829, CWE-494, CWE-327
Timeline of GlassWorm Supply Chain Campaign
- GlassWorm first discovered — 7 compromised OpenVSX extensions identified with 35,800 cumulative downloads using invisible Unicode obfuscation and Solana blockchain C2
- GlassWorm detected in Microsoft VSCode Marketplace (cline-ai-main.cline-ai-agent), 10 extensions still actively distributing malware
- Second wave emerges on OpenVSX — 3 new compromised extensions (ai-driven-dev, history-in-sublime-merge, transient-emacs) with stolen GitHub credentials enabling AI-generated malicious commits
- Third wave — 24 malicious extensions impersonating popular developer tools (Flutter, React, Tailwind, Vim, Vue) across both VSCode Marketplace and Open VSX
- Fourth wave targeting macOS developers exclusively — AES-256-CBC encrypted payloads with 15-minute execution delay, LaunchAgent persistence, Keychain credential harvesting
- Comprehensive GlassWorm campaign report published documenting full self-propagation mechanism, triple-layer C2 architecture, and credential harvesting capabilities
- Extensions remain live on Open VSX registry during Socket Security disclosure, ongoing takedown efforts in progress
- Socket Security documents evolution: decryption keys moved from embedded code to HTTP response headers (ivbase64, secretkey), Russian locale geofencing added as execution guardrail
- Fifth wave — 73 malicious Open VSX extensions discovered using transitive dependency abuse via extensionPack/extensionDependencies fields, RC4/base64 obfuscation replacing earlier AES, Solana wallet rotation to new addresses
- As of 2026-05-29, the GlassWorm campaign's active threat is neutralized: on May 26 CrowdStrike, Google and Shadowserver simultaneously severed all four C2 channels (Solana, BitTorrent DHT, Google Calendar, VPS), sinkholing victims so payloads can no longer be delivered. However, the operators are not confirmed defunct and showed resilient, evolving infrastructure over 15+ months, so reconstitution is plausible.
Sources cited for GlassWorm Supply Chain Campaign
- Socket Security - 73 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies
- Truesec - GlassWorm: Self-Propagating VSCode Extension Worm
- BleepingComputer - Glassworm Malware Returns in Third Wave of Malicious VS Code Packages
- SecurityWeek - GlassWorm Malware Returns to Open VSX, Emerges on GitHub
- The Hacker News - GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools
- Security Affairs - GlassWorm Malware Has Resurfaced on the Open VSX Registry
- Dark Reading - GlassWorm Returns, Slices Back into VS Code Extensions
- Rewterz - GlassWorm Malware Targets macOS via Trojanized VSCode Extensions
- Fluid Attacks - GlassWorm Supply Chain Attack Analysis
- Veracode - GlassWorm: The First Self-Propagating VS Code Extension Worm
- Koi Security - GlassWorm Analysis: Invisible Code Hits OpenVSX Marketplace
- Open Source For You - GlassWorm Malware Abuses Open Source Open VSX To Target macOS Developers
Threats related to GlassWorm Supply Chain Campaign
- GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
- GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
- GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
- GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
- TeamPCP Supply Chain Attack via Backdoored Telnyx PyPI Package with Steganographic WAV Payloads
- GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers
Detection coverage for TL-2026-0224
As of 2026-03-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0224 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.