GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX
GlassWorm Supply Chain Attack via Trojanized VS Code (TL-2026-0247), also tracked as GlassWorm Campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-18. It is attributed to GlassWorm with medium confidence, affects Open VSX Open VSX Registry, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0247
- Threat ID
- TL-2026-0247
- Also known as
- GlassWorm Campaign, GlassWorm Supply Chain Worm
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- DORMANT
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-18
- Last reviewed
- 2026-03-18
- Attribution
- GlassWorm
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, financial, cryptocurrency, government, healthcare, education
- Target regions
- Global (excludes Russia)
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in GlassWorm Supply Chain Attack via Trojanized VS Code
Malware and tooling: 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ
GlassWorm is an active, multi-wave supply chain campaign distributing 72+ trojanized VS Code extensions through the Open VSX registry. Extensions use sleeper activation, blockchain-based C2 via Solana dead-drop resolvers, and GitHub-hosted VSIX payloads to achieve arbitrary code execution in developer environments including VS Code, VSCodium, Cursor, Windsurf, and Positron.
How GlassWorm Supply Chain Attack via Trojanized VS Code works
GlassWorm is a sophisticated, persistent supply chain attack campaign targeting developer environments through trojanized Visual Studio Code extensions distributed via the Open VSX registry. First discovered by Koi Security in October 2025, the campaign has evolved through multiple waves, with the latest and most aggressive phase activating on March 17-18, 2026.
The attack employs a novel two-phase deployment model. In the planting phase (March 12, 2026), benign extensions are published to Open VSX under attacker-controlled publisher accounts such as laura6909, martina0094, chiara585, and francesca898. These extensions contain no malicious functionality and pass standard code review. In the weaponization phase (March 17-18), the extensions receive updates that convert them into "extension packs" using the extensionPack and extensionDependencies manifest fields to pull in malicious dependency extensions, creating a transitive delivery chain that bypasses per-extension security scanning.
The malware's command and control infrastructure is built on the Solana blockchain, using a dead-drop resolver pattern. The loader queries the Solana wallet 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ for recent transactions containing base64-encoded payload URLs in memo fields. This architecture provides extreme resilience—C2 rotation costs approximately $0.001 per Solana transaction, and blockchain immutability makes traditional takedowns ineffective. The loader implements nine RPC endpoint fallbacks (including Tatum, GetBlock, BlockEden, and publicnode) with 100ms retry delays and 1-second per-endpoint timeouts.
Payload delivery uses GitHub releases as a hosting platform rather than the Open VSX registry itself, circumventing registry-level takedowns. Malicious VSIX files are hosted on throwaway GitHub accounts (chiara585/fwefwewvwfe, francesca898/dqwffqw) and downloaded at activation time.
The malware payload is injected exclusively into compiled JavaScript (extension.js), not TypeScript source—creating a critical source/binary divergence that defeats code review. In the 96-studio.json-formatter extension, the compiled JS expanded from 36 lines (matching source) to 659 lines, with 623 lines of obfuscated payload injected between the function signature and legitimate code. Obfuscation employs RC4 string decryption, runtime-shuffled encrypted string arrays (176 entries), multiple proxy decoder functions with offset calculations, and string splitting of function names.
Execution follows a multi-stage chain: (1) 10-second activation delay via setTimeout, (2) Russian geofence check examining hostname, locale variables (ru_RU, ru-RU), timezone against 13 Russian cities from Moscow to Kamchatka, and UTC offsets +2 to +12—exiting if domestic, (3) persistence via JSON timestamp written to $HOME with 48-hour cooldown between C2 polls, (4) Solana wallet signature polling via JSON-RPC, (5) encrypted payload fetch with IV in response headers and decryption key in secretkey header using AES-256-CBC, (6) three execution paths—direct eval() for short payloads, a separate macOS path using LaunchAgent/LaunchDaemon persistence, or full vm.Script.runInContext sandbox on other platforms granting require, Buffer, process, console, and timer access.
The campaign's capabilities include credential harvesting (NPM, GitHub, Git tokens), cryptocurrency wallet theft targeting 49 wallet extensions, SSH key exfiltration, macOS Keychain credential theft, SOCKS proxy deployment turning developer machines into criminal infrastructure, and hidden VNC server installation for complete remote access.
The broader GlassWorm campaign has compromised 400+ components across GitHub, npm, VS Code Marketplace, and Open VSX, with approximately 151 GitHub repositories affected between March 3-9, 2026 alone through invisible Unicode injection techniques. The campaign targets all major VS Code-compatible IDEs: VS Code, VSCodium, Cursor, Windsurf, and Positron.
MITRE ATT&CK techniques used in TL-2026-0247
collection
defense-evasion
T1027 Obfuscated Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1090 Proxy; T1102 Web Service; T1573 Encrypted Channel
persistence
T1176 Software Extensions; T1543 Create or Modify System Process
initial-access
impact
credential-access
T1552 Unsecured Credentials; T1555 Credentials from Password Stores
resource-development
Affected products and versions in GlassWorm Supply Chain Attack via Trojanized VS Code
- Open VSX — Open VSX Registry
Vulnerable versions: All
Fixed in: Affected extensions removed - Microsoft — Visual Studio Code
Vulnerable versions: All versions with Open VSX extension support - VSCodium — VSCodium
Vulnerable versions: All - Anysphere — Cursor
Vulnerable versions: All - Codeium — Windsurf
Vulnerable versions: All - Posit — Positron
Vulnerable versions: All
Remediation for GlassWorm Supply Chain Attack via Trojanized VS Code
Immediate actions
- Audit all installed VS Code extensions against known GlassWorm publisher accounts (laura6909, martina0094, chiara585, francesca898)
- Remove any extensions from untrusted Open VSX publishers installed after March 1, 2026
- Block network access to Solana RPC endpoints from developer workstations where not required
- Block GitHub raw/release download URLs from unknown repositories at proxy level
- Scan developer machines for /tmp/ijewf/ staging directory and unexpected LaunchAgents/LaunchDaemons
- Rotate all NPM, GitHub, and Git tokens on potentially affected developer machines
- Audit SSH keys and revoke any created during the exposure window
Workarounds
- Disable automatic extension updates in VS Code and all compatible IDEs
- Use VS Code extension trust settings to restrict extension execution
- Configure firewall rules to block outbound Solana RPC traffic (api.mainnet-beta.solana.com and known RPC providers)
- Pin known-good extension versions and verify SHA256 hashes before updates
Longer-term hardening
- Implement extension allowlisting policies restricting VS Code extensions to vetted publishers only
- Deploy EDR with behavioral detection for eval()/vm.Script execution from extension host processes
- Monitor for Solana blockchain RPC queries from developer workstations
- Implement source-to-binary verification for all IDE extensions in the supply chain
- Deploy network monitoring for SOCKS proxy and VNC traffic from developer endpoints
- Establish extension review processes that compare compiled JS against TypeScript source
Weaknesses (CWE) in GlassWorm Supply Chain Attack via Trojanized VS Code
CWE-506, CWE-829, CWE-494, CWE-502
Timeline of GlassWorm Supply Chain Attack via Trojanized VS Code
- GlassWorm first discovered by Koi Security researchers in three malicious VS Code extensions on Open VSX marketplace
- First Solana blockchain C2 transactions observed; attacker begins posting payload URLs via memo fields to wallet 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ
- GlassWorm returns with 24 malicious extensions impersonating popular developer tools, reported by The Hacker News
- Socket Security identifies 72 new malicious Open VSX extensions since this date, marking the largest GlassWorm wave to date
- GitHub repository injection wave begins using invisible Unicode characters to hide payloads in 151+ repositories
- GitHub repository injection wave ends; Aikido Security publishes analysis of 151 compromised repositories
- Sleeper extensions planted on Open VSX as benign packages under accounts laura6909 and martina0094
- 18+ impersonation extensions published targeting popular developer tools including Claude Code assistants and Angular tooling
- Sleeper extensions updated to extension packs, wiring in malicious dependencies via extensionPack manifest field
- Socket Security publishes full technical analysis of sleeper activation mechanism and Solana blockchain C2 infrastructure
- 96-studio.json-formatter@0.0.2 activated, downloading malicious VSIX payload from GitHub repo chiara585/fwefwewvwfe
- lauracode.wrap-selected-code@0.0.2 activated with independent GitHub payload delivery from francesca898/dqwffqw
- As of 2026-05-29, GlassWorm's operational capability is severed: a May 26 CrowdStrike/Google/Shadowserver takedown disrupted all four C2 channels (Solana, Google Calendar, BitTorrent DHT, VPS), sinkholing infected hosts. But no arrests occurred, the malware persists on victims, and the "well-resourced, persistent" operators have repeatedly resurfaced, so it is dormant, not resolved.
Sources cited for GlassWorm Supply Chain Attack via Trojanized VS Code
- GlassWorm Sleeper Extensions Activate on Open VSX, Shift to GitHub-Hosted VSIX Malware
- GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers
- GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
- GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2
- GlassWorm on macOS: Malicious VS Code Extensions via Solana
- GlassWorm: First Self-Propagating Worm Using Invisible Code
- GlassWorm: Self-Propagating VSCode Extension Worm
- Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories
- Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm
- GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools
- GitHub: Glassworm Hides Malware in Invisible Unicode Across 151+ Repos
- GlassWorm: The First Self-Propagating VS Code Extension Worm
Threats related to GlassWorm Supply Chain Attack via Trojanized VS Code
- GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
- GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
- GlassWorm VS Code Extension Supply Chain Attack - Open VSX Hijack
- GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers
- GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
Detection coverage for TL-2026-0247
As of 2026-03-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0247 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.