GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX — Threadlinqs Intelligence
As of 2026-05-30, GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX is a critical-severity supply chain threat attributed to GlassWorm (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0247 · Severity: CRITICAL · CVSS: 9.8 · Status: DORMANT · Category: SUPPLY_CHAIN
Attribution: GlassWorm · N/A · FINANCIAL
GlassWorm is an active, multi-wave supply chain campaign distributing 72+ trojanized VS Code extensions through the Open VSX registry. Extensions use sleeper activation, blockchain-based C2 via Solana
GlassWorm is a sophisticated, persistent supply chain attack campaign targeting developer environments through trojanized Visual Studio Code extensions distributed via the Open VSX registry. First discovered by Koi Security in October 2025, the campaign has evolved through multiple waves, with the latest and most aggressive phase activating on March 17-18, 2026.
The attack employs a novel two-phase deployment model. In the planting phase (March 12, 2026), benign extensions are published to Open VSX under attacker-controlled publisher accounts such as laura6909, martina0094, chiara585, and francesca898. These extensions contain no malicious functionality and pass standard code review. In the weaponization phase (March 17-18), the extensions receive updates that convert them into "extension packs" using the extensionPack and extensionDependencies manifest fields to pull in malicious dependency extensions, creating a transitive delivery chain that bypasses per-extension security scanning.
The malware's command and control infrastructure is built on the Solana blockchain, using a dead-drop resolver pattern. The loader queries the Solana wallet 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ for recent transactions containing base64-encoded payload URLs in memo fields. This architecture provides extreme resilience—C2 rotation costs approximately $0.001 per Solana transaction, and blockchain immutability makes traditional takedowns ineffective. The loader implements nine RPC endpoint fallbacks (including Tatum, GetBlock, BlockEden, and publicnode) with 100ms retry delays and 1-second per-endpoint timeouts.
Payload delivery uses GitHub releases as a hosting platform rather than the Open VSX registry itself, circumventing registry-level takedowns. Malicious VSIX files are hosted on throwaway GitHub accounts (chiara585/fwefwewvwfe, francesca898/dqwffqw) and downloaded at activation time.
The malware payload is injected exclusively into compiled JavaScript (extension.js), not TypeScript source—creating a critical source/binary divergence that defeats code review. In the 96-studio.json-formatter extension, the compiled JS expanded from 36 lines (matching source) to 659 lines, with 623 lines of obfuscated payload injected between the function signature and legitimate code. Obfuscation employs RC4 string decryption, runtime-shuffled encrypted string arrays (176 entries), multiple proxy decoder functions with offset calculations, and string splitting of function names.
Execution follows a multi-stage chain: (1) 10-second activation delay via setTimeout, (2) Russian geofence check examining hostname, locale variables (ru_RU, ru-RU), timezone against 13 Russian cities from Moscow to Kamchatka, and UTC offsets +2 to +12—exiting if domestic, (3) persistence via JSON timestamp written to $HOME with 48-hour cooldown between C2 polls, (4) Solana wallet signature polling via JSON-RPC, (5) encrypted payload fetch with IV in response headers and decryption key in secretkey header using AES-256-CBC, (6) three execution paths—direct eval() for short payloads, a separate macOS path using LaunchAgent/LaunchDaemon persistence, or full vm.Script.runInContext sandbox on other platforms granting require, Buffer, process, console, and timer access.
The campaign's capabilities include credential harvesting (NPM, GitHub, Git tokens), cryptocurrency wallet theft targeting 49 wallet extensions, SSH key exfiltration, macOS Keychain credential theft, SOCKS proxy deployment turning developer machines into criminal infrastructure, and hidden VNC server installation for complete remote access.
The broader GlassWorm campaign has compromised 400+ components across GitHub, npm, VS Code Marketplace, and Open VSX, with approximately 151 GitHub repositories affected between March 3-9, 2026 alone through invisible Unicode injection techniques. The campaign targets all major VS Code-compatible IDEs: VS Code, VSCodium, Cursor, Windsurf, and Positron.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-502
Target sectors: technology, software-development, financial, cryptocurrency, government, healthcare, education
Target regions: Global (excludes Russia)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1204, T1059, T1176, T1543, T1543, T1480, T1027, T1027, T1027