GlassWorm Supply Chain Attack: Fake Browser Extension & Multi-Stage RAT via Compromised Developer Packages
GlassWorm Supply Chain Attack (TL-2026-0287), also tracked as GlassWorm, is a high-severity supply-chain compromise, first published 2026-03-26. It is attributed to GlassWorm Operator with low confidence, affects npm npm Registry Packages, maps to 29 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0287
- Threat ID
- TL-2026-0287
- Also known as
- GlassWorm, ForceMemo
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-26
- Last reviewed
- 2026-03-26
- Attribution
- GlassWorm Operator
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, financial, open-source
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in GlassWorm Supply Chain Attack
Malware and tooling: 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ, BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC, DSRUBTziADDHSik7WQvSMjvwCHFsbsThrbbjWMoJPUiW
GlassWorm is an active multi-stage supply chain attack targeting developers through 433+ compromised npm, PyPI, GitHub, and VS Code/OpenVSX packages. The infection chain delivers an infostealer, a Node.js RAT with Solana blockchain-based C2 dead-drop resolution, and a force-installed fake Chrome extension ('Google Docs Offline') for persistent browser surveillance including keylogging, DOM capture, credential theft, and cryptocurrency wallet exfiltration.
How GlassWorm Supply Chain Attack works
GlassWorm is a persistent, evolving supply chain campaign that establishes initial access through rogue packages published across multiple developer ecosystems: npm, PyPI, GitHub repositories, VS Code Marketplace, and OpenVSX. The campaign has compromised over 433 components as of March 2026, including 200 GitHub Python repositories, 151 JavaScript/TypeScript repositories, 72 VS Code/OpenVSX extensions, and 10+ npm packages. The attack employs a novel obfuscation technique using Unicode Private Use Area (PUA) characters in the ranges U+FE00-U+FE0F (Variation Selectors) and U+E0100-U+E01EF (Variation Selectors Supplement) to hide malicious payloads. These characters render as zero-width whitespace in code editors, making visual detection impossible. A hidden decoder extracts bytes from these characters and passes them to JavaScript's eval() function for execution. The multi-stage infection chain begins with compromised packages executing preinstall hooks or invisible Unicode loaders. The malware first fingerprints the victim machine and implements geofencing by checking the OS locale against Russian patterns (ru_RU, ru-RU) and timezone against Russian timezone ranges (Europe/Moscow through Asia/Anadyr), skipping execution if a Russian locale is detected. C2 infrastructure leverages the Solana blockchain as a dead-drop resolver. The attacker owns private keys for Solana addresses and uses Solana's Memo program to post JSON instructions containing C2 server URLs. Victim malware queries these addresses via Solana RPC endpoints, reads the latest memo, and decodes the base64 link field to obtain the active C2 URL. The primary C2 discovery uses DHT (Distributed Hash Table) lookup for a pinned public key, with Solana serving as fallback. Stage 2 deploys a comprehensive data-theft framework targeting browser credentials (login data, cookies, autofill, payment cards), cryptocurrency wallet credentials, npm tokens (validated in real-time against the npm registry), GitHub tokens, SSH keys, VS Code secrets, cloud credentials, and environment variables. Stolen data is compressed to ZIP and exfiltrated. Stage 3 delivers two additional components: (a) a .NET binary (Assaac.exe) that monitors for USB hardware wallet insertion via WMI and presents phishing interfaces for Ledger/Trezor seed phrase capture, and (b) a Node.js RAT with a Chrome extension installer. The RAT maintains persistence through scheduled tasks at highest privileges, registry Run keys, and process signal hooks (SIGINT, SIGTERM, SIGQUIT, SIGHUP, SIGUSR2) for auto-restart on termination. The force-installed Chrome extension masquerades as 'Google Docs Offline' (v1.95.1) and is installed without user consent via native modules. It registers with a C2 server resolved from a separate Solana wallet memo, polls for commands at 5-30 second intervals, and supports extensive surveillance capabilities: cookie and localStorage theft, full DOM tree capture, screenshot capture, keystroke logging with form metadata, clipboard monitoring, browser history extraction (up to 5,000 entries), bookmark export, and installed extension enumeration. The extension includes pre-configured targeting for Bybit cryptocurrency exchange with webhook alerting on authentication detection. The campaign has evolved to include 'ForceMemo' — a variant that uses stolen GitHub tokens to inject malicious code into legitimate Python repositories via force-push, preserving original commit metadata to evade detection. This affects Django apps, ML research code, Streamlit dashboards, and PyPI packages. Two compromised React Native npm packages alone had 130,000+ monthly downloads. GlassWorm also targets the MCP (Model Context Protocol) ecosystem, publishing npm packages impersonating the WaterCrawl MCP server, marking the campaign's expansion into AI developer tooling supply chains.
MITRE ATT&CK techniques used in TL-2026-0287
collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking
command-and-control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
discovery
T1082 System Information Discovery; T1518 Software Discovery
persistence
T1176 Software Extensions; T1547 Boot or Logon Autostart Execution
initial-access
impact
credential-access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
resource-development
T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
Affected products and versions in GlassWorm Supply Chain Attack
- npm — npm Registry Packages
Vulnerable versions: @aifabrix/miso-client v4.7.2; @iflow-mcp/watercrawl-watercrawl-mcp v1.3.0-1.3.4; react-native-international-phone-number v0.11.8; react-native-country-select v0.3.91 - Microsoft — VS Code / OpenVSX Extensions
Vulnerable versions: 72+ malicious extensions since January 31, 2026 - GitHub — GitHub Repositories
Vulnerable versions: 351+ repositories (200 Python, 151 JS/TS) compromised March 3-9, 2026 - Google — Chrome / Chromium Browsers
Vulnerable versions: All versions (force-installed extension) - Microsoft — Windows
Vulnerable versions: Windows 10, Windows 11 - Apple — macOS
Vulnerable versions: All current versions
Remediation for GlassWorm Supply Chain Attack
Immediate actions
- Block C2 IPs at perimeter: 45.32.150.251, 217.69.3.152, 217.69.0.159, 45.150.34.158
- Scan all developer workstations for IOC markers: lzcdrtfxyqiplpd variable, QtCvyfVWKH directory, AghzgY.ps1 script
- Check Chrome extensions for unauthorized 'Google Docs Offline' in jucku or myextension directories
- Audit npm/pip/VS Code extension installations against known malicious package list
- Revoke and rotate all npm tokens, GitHub tokens, SSH keys, and cloud credentials on affected machines
- Block Solana RPC endpoint connections from developer workstations
- Remove scheduled task 'UpdateApp' and registry Run keys 'UpdateApp'/'UpdateLedger' from affected systems
Workarounds
- Disable npm preinstall script execution: npm config set ignore-scripts true (then manually audit scripts)
- Disable VS Code auto-install of extension dependencies
- Use glassworm-hunter (AFINE, open-source) for local codebase scanning
- Pin all dependencies to known-good versions and verify checksums
Longer-term hardening
- Implement package-lock.json and npm audit in CI/CD pipelines
- Deploy EDR with behavioral detection for invisible Unicode character execution patterns
- Enforce VS Code extension allowlisting via organizational policies
- Implement GitHub branch protection rules preventing force-push on default branches
- Deploy network monitoring for DHT and Solana blockchain C2 patterns
- Establish code signing and provenance verification for all internal packages
- Monitor for Chrome policy registry/plist modifications indicating force-installed extensions
Weaknesses (CWE) in GlassWorm Supply Chain Attack
CWE-506, CWE-829, CWE-494, CWE-116
Timeline of GlassWorm Supply Chain Attack
- Initial GlassWorm campaign detected and flagged by Koi Security researchers
- Solana wallet transaction activity began for C2 dead-drop infrastructure; 50 transactions recorded through March 2026
- Beginning of new wave: 72 malicious VS Code/OpenVSX extensions published starting from this date
- Start of coordinated GitHub repository injection campaign targeting 351+ Python and JavaScript repositories
- Earliest ForceMemo injections detected — stolen GitHub tokens used to force-push malware into Python repos
- GitHub repository injection campaign concludes; 200 Python and 151 JS/TS repositories compromised
- Malicious npm packages @aifabrix/miso-client and @iflow-mcp/watercrawl-watercrawl-mcp published, targeting MCP ecosystem
- Socket Security publishes report on 72 malicious OpenVSX extensions linked to GlassWorm
- Aikido Security and StepSecurity report compromised React Native npm packages; Bleeping Computer confirms 433+ total compromised components
- The Hacker News publishes detailed technical analysis of Solana dead-drop C2 mechanism and ForceMemo variant
- Malwarebytes and Aikido Security publish detailed analysis of Chrome extension RAT capabilities and full attack chain
- As of 2026-05-29, GlassWorm's C2 was disrupted on May 26 by CrowdStrike/Google/Shadowserver (all 4 channels sinkholed), but researchers call it "disruption, not eradication"—operators remain at large, hundreds of poisoned repos persist, and the malware has resurged 4 times before, so resurgence is expected.
Sources cited for GlassWorm Supply Chain Attack
- Malwarebytes: GlassWorm attack installs fake browser extension for surveillance
- The Hacker News: GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data
- The Hacker News: GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
- The Hacker News: GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers
- Aikido Security: GlassWorm RAT Delivered via Malicious Chrome Extension (Keylogger, Cookie Theft)
- Aikido Security: Glassworm Returns - Invisible Unicode Malware Found in 150+ GitHub Repositories
- Bleeping Computer: GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX
- SecurityWeek: ForceMemo - Python Repositories Compromised in GlassWorm Aftermath
- Security Boulevard: An Evolving GlassWorm Malware is Making the Rounds of Code Repositories
- StepSecurity: ForceMemo - Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push
- AFINE glassworm-hunter: Open-source detection tool
Threats related to GlassWorm Supply Chain Attack
- GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
- GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
- GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
- Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)
- PolinRider DPRK Supply-Chain Campaign: Confirmed GitHub Footprint Grows 6.5x Since March (JADESNOW/Beavertail/InvisibleFerret Loaders, DEV#POPPER & OmniStealer Payloads)
- GhostClaw Supply Chain Campaign: Malicious GitHub Repos and AI Workflow SKILL.md Files Deliver GhostLoader macOS Infostealer via trackpipe[.]dev C2
Detection coverage for TL-2026-0287
As of 2026-03-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0287 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.