# GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies

> The GlassWorm campaign has escalated to deliver 73 malicious VS Code extensions via the Open VSX registry, abusing extensionPack and extensionDependencies manifest fields for transitive installation of staged JavaScript loaders. The loaders employ RC4/base64 obfuscation, Russian locale geofencing, and Solana blockchain transaction memos as dead drop resolvers to exfiltrate tokens, credentials, and environment secrets from developer workstations.

- **Published:** 2026-03-13T12:00:00Z
- **Last reviewed:** 2026-03-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0224
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-glassworm-open-vsx-campaign-tl-2026-0224.webp?v=3545f578 (Threadlinqs threat intel: GlassWorm 73 Transitive Dependencies: Detection & IOCs (TL-2026-0224) — High severity, 27 IOCs, 9 detection rules.)
- **ID:** TL-2026-0224
- **Severity:** HIGH (CVSS 8.6)
- **Category:** SUPPLY_CHAIN
- **Status:** DORMANT
- **Actor:** GlassWorm (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

The GlassWorm supply chain campaign represents a significant escalation in developer ecosystem attacks, now leveraging transitive dependency abuse in VS Code extension manifests to achieve silent mass installation of malicious payloads. First documented in October 2025 as a self-propagating worm targeting OpenVSX, GlassWorm has evolved through multiple waves — November 2025 OpenVSX resurgence, December 2025 VSCode Marketplace expansion, January 2026 macOS-focused campaign, and now the March 2026 transitive dependency wave comprising 73 extensions.

The March 2026 wave introduces a novel delivery mechanism: abuse of the extensionPack and extensionDependencies fields in VS Code extension manifests. An extension appearing benign at publication is later updated to reference malicious extensions in these fields, causing automatic transitive installation through the editor's normal update mechanism. This amplifies reach far beyond direct installs — any developer with the parent extension receives malicious children silently.

The attack chain employs multi-stage JavaScript loaders with progressive obfuscation. Initial variants used static AES-256-CBC wrapped loaders, but current iterations have shifted to RC4/base64 encoding with string-array obfuscation. Decryption keys have migrated from embedded extension code to HTTP response headers (ivbase64, secretkey), making static analysis significantly harder. The loaders implement Russian locale and timezone geofencing, enabling selective execution and anti-analysis behavior.

Command-and-control infrastructure uses a triple-layer architecture: (1) Solana blockchain transaction memos as dead drop resolvers — the Memo program at MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr distributes C2 endpoints that cannot be taken down; (2) direct IP connections to Vultr-hosted servers; (3) Google Calendar as a backup C2 channel. Wallet rotation between BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC and 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ demonstrates active operational security.

Post-execution payloads operate entirely in memory via eval and vm.Script with full Node.js primitives exposed. Exfiltration targets include: npm tokens, GitHub credentials, Git configuration, VS Code session tokens, environment variables (.env files), macOS Keychain passwords, and 49+ cryptocurrency wallet browser extensions including Ledger Live and Trezor Suite. Stolen credentials are weaponized for self-propagation — compromising additional packages and extensions to create exponential spread.

Infrastructure analysis reveals strong continuity across all GlassWorm waves through overlapping IP reuse (45.32.150.251 persistent across campaigns), consistent Solana-based C2, shared cryptographic material, and evolving but recognizable loader architecture. The campaign operator demonstrates sophisticated tradecraft with progressive TTPs while maintaining operational infrastructure links.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1102 Web Service
- T1573 Encrypted Channel
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GlassWorm Post-Exploitation — Developer Credential and Token File Access by Node.js Process** (`TL-2026-0224-SPL-002`)

Detects Node.js or VS Code processes accessing sensitive developer credential files (.npmrc, .git-credentials, .env, GitHub CLI hosts.yml, AWS credentials). GlassWorm's post-exploitation payload harvests npm tokens, GitHub PATs, Git configuration, VS Code session tokens, environment variables, and SSH keys from developer workstations. This detection targets the credential harvesting phase where the in-memory payload enumerates and reads these files.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1552.001, T1528, T1005
- **Data sources:** sysmon, microsoft_defender_for_endpoint, file_access_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where match(Image, "(?i)(node|Code|code-insiders|codium|cursor)\.exe$")
| where match(CommandLine, "(?i)(\.npmrc|\.git-credentials|\.gitconfig|\.env|hosts\.yml|credentials|login\.keychain)")
| eval cred_type=case(
    match(CommandLine, "(?i)\.npmrc"), "npm_token",
    match(CommandLine, "(?i)\.git-credentials"), "git_credentials",
    match(CommandLine, "(?i)\.env"), "env_secrets",
    match(CommandLine, "(?i)hosts\.yml"), "github_cli_token",
    match(CommandLine, "(?i)credentials"), "aws_credentials",
    match(CommandLine, "(?i)keychain"), "macos_keychain",
    1=1, "unknown"
)
| stats count values(cred_type) AS targeted_credentials by _time, Computer, User, Image, ParentImage
| where count >= 2
| table _time, Computer, User, Image, ParentImage, count, targeted_credentials
```

### Microsoft KQL

```kql
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "Code.exe", "code-insiders.exe", "codium.exe", "cursor.exe")
    or FileName in~ ("node.exe", "Code.exe")
| where FolderPath matches regex @"(?i)(\.npmrc|\.git-credentials|\.gitconfig|\.env$|hosts\.yml|aws[/\\]credentials|login\.keychain)"
    or ProcessCommandLine matches regex @"(?i)(\.npmrc|\.git-credentials|\.gitconfig|\.env|\.ssh[/\\]id_rsa)"
| extend CredentialType = case(
    FolderPath has ".npmrc" or ProcessCommandLine has ".npmrc", "npm_token",
    FolderPath has ".git-credentials" or ProcessCommandLine has ".git-credentials", "git_credentials",
    FolderPath has ".env" or ProcessCommandLine has ".env", "env_secrets",
    FolderPath has "hosts.yml", "github_cli_token",
    FolderPath has "aws" and FolderPath has "credentials", "aws_credentials",
    FolderPath has "keychain", "macos_keychain",
    "other"
)
| summarize CredentialTypes = make_set(CredentialType), AccessCount = count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, bin(Timestamp, 10m)
| where AccessCount >= 2
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, AccessCount, CredentialTypes
```

### Sigma

```yaml
title: GlassWorm Post-Exploitation — Developer Credential and Token File Access by Node.js Process
id: a1b2c3d4-2001-4a5b-8c7d-e9f0a1b2c304
status: experimental
description: Detects Node.js or VS Code processes accessing multiple developer credential files (.npmrc, .git-credentials, .env, hosts.yml) within a short window — characteristic of GlassWorm credential harvesting.
references:
    - https://socket.dev/blog/open-vsx-transitive-glassworm-campaign
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-03-13
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1528
    - attack.collection
    - attack.t1005
logsource:
    product: windows
    category: file_access
detection:
    selection_process:
        Image|endswith:
            - '\node.exe'
            - '\Code.exe'
            - '\code-insiders.exe'
            - '\codium.exe'
            - '\cursor.exe'
    selection_files:
        TargetFilename|endswith:
            - '.npmrc'
            - '.git-credentials'
            - '.gitconfig'
            - '.env'
            - 'hosts.yml'
            - 'id_rsa'
    condition: selection_process and selection_files
falsepositives:
    - Legitimate VS Code extensions that manage Git configuration (e.g., GitLens)
    - npm CLI operations that read .npmrc for registry configuration
    - Development tools that parse .env files for environment setup
level: high
```

**Known false positives:**

- Legitimate VS Code extensions that manage Git configuration (e.g., GitLens)
- npm CLI operations that read .npmrc for registry configuration
- Development tools that parse .env files for environment setup

**Tuning notes:** Increase the threshold count from 2 to 3+ if legitimate developer tooling frequently accesses these files. Correlate with network connections to external IPs within 60 seconds of file access for higher confidence. Exclude known-good extension processes by hash or path. Add .ssh/id_rsa and macOS Keychain paths for broader coverage.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GlassWorm Exploitation — Obfuscated JavaScript Loader Execution from VS Code Extension Host (locked: unlock with TL Creds)
- GlassWorm Post-Exploitation — Persistence via Registry Run Key or LaunchAgent from Extension Context (locked: unlock with TL Creds)
- GlassWorm C2 — Solana Blockchain Dead Drop Resolution or Google Calendar Backup C2 Access (locked: unlock with TL Creds)
- GlassWorm Exploitation — Extension Manifest Modification with Transitive Dependency Injection (locked: unlock with TL Creds)
- GlassWorm Post-Exploitation — Russian Locale Geofencing Check by VS Code Extension Process (locked: unlock with TL Creds)
- GlassWorm C2 — HTTP Response with Dynamic Decryption Key Headers (ivbase64/secretkey) (locked: unlock with TL Creds)
- GlassWorm Exploitation — Suspicious VS Code Extension Mass Installation via Transitive Dependencies (locked: unlock with TL Creds)
- GlassWorm C2 — Outbound Network Connection to Known GlassWorm Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `45.32.150[.]251`
- URL: `hxxps://calendar[.]app[.]google/M2ZCvM8ULL56PD1d6`
- Email address: `uhjdclolkdn[@]gmail[.]com`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Socket Security - 73 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies](https://socket.dev/blog/open-vsx-transitive-glassworm-campaign)
- [Truesec - GlassWorm: Self-Propagating VSCode Extension Worm](https://www.truesec.com/hub/blog/glassworm-self-propagating-vscode-extension)
- [BleepingComputer - Glassworm Malware Returns in Third Wave of Malicious VS Code Packages](https://www.bleepingcomputer.com/news/security/glassworm-malware-returns-in-third-wave-of-malicious-vs-code-packages/)
- [SecurityWeek - GlassWorm Malware Returns to Open VSX, Emerges on GitHub](https://www.securityweek.com/glassworm-malware-returns-to-open-vsx-emerges-on-github/)
- [The Hacker News - GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools](https://thehackernews.com/2025/12/glassworm-returns-with-24-malicious.html)
- [Security Affairs - GlassWorm Malware Has Resurfaced on the Open VSX Registry](https://securityaffairs.com/184427/malware/glassworm-malware-has-resurfaced-on-the-open-vsx-registry.html)
- [Dark Reading - GlassWorm Returns, Slices Back into VS Code Extensions](https://www.darkreading.com/cyberattacks-data-breaches/glassworm-returns-vs-code-extensions)
- [Rewterz - GlassWorm Malware Targets macOS via Trojanized VSCode Extensions](https://rewterz.com/threat-advisory/glassworm-malware-targets-macos-via-trojanized-vscode-extensions-active-iocs)
- [Fluid Attacks - GlassWorm Supply Chain Attack Analysis](https://fluidattacks.com/blog/glassworm-vs-code-extensions-supply-chain-attack)
- [Veracode - GlassWorm: The First Self-Propagating VS Code Extension Worm](https://www.veracode.com/blog/glassworm-vs-code-extension/)
- [Koi Security - GlassWorm Analysis: Invisible Code Hits OpenVSX Marketplace](https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace)
- [Open Source For You - GlassWorm Malware Abuses Open Source Open VSX To Target macOS Developers](https://www.opensourceforu.com/2026/01/glassworm-malware-abuses-open-source-open-vsx-to-target-macos-developers/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0224