GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers

Key facts for GlassWorm v2 sleeper extensions

Detection coverage for GlassWorm v2 sleeper extensions

As of 2026-04-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0421 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GlassWorm v2 — IDE Spawns --install-extension With On-Disk VSIX (Exploitation)

Detects VS Code, Cursor, Windsurf or VSCodium CLIs invoked with `--install-extension` pointing at a local filesystem .vsix path rather than a marketplace publisher.name identifier. This is the secondary VSIX deployment step in the GlassWorm v2 chain where the native loader.node silently chains a second malicious extension into the IDE, establishing redundant persistence under a different publisher account.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1204.002, T1554, T1059.007
• Data sources: sysmon, windows_security, edr_process_creation, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\code.exe" OR Image="*\\cursor.exe" OR Image="*\\windsurf.exe" OR Image="*\\codium.exe" OR Image="*/code" OR Image="*/cursor" OR Image="*/windsurf" OR Image="*/codium")
  CommandLine="*--install-extension*"
| rex field=CommandLine "--install-extension\s+(?<install_arg>\S+)"
| eval is_local_vsix=if(match(install_arg, "(?i).*\.vsix($|\")"), 1, 0)
| eval is_marketplace_id=if(match(install_arg, "^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+(@[0-9.]+)?$"), 1, 0)
| where is_local_vsix=1 AND is_marketplace_id=0
| stats count min(_time) as first_seen max(_time) as last_seen values(install_arg) as vsix_path values(ParentImage) as parent_process by host, User, Image, CommandLine
| where count >= 1
| eval threat="GlassWorm v2 secondary VSIX persistence — TL-2026-0421"
| table first_seen last_seen host User Image parent_process CommandLine vsix_path threat

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("code.exe", "cursor.exe", "windsurf.exe", "codium.exe", "code", "cursor", "windsurf", "codium")
| where ProcessCommandLine has "--install-extension"
| extend InstallArg = extract(@"--install-extension\s+(\S+)", 1, ProcessCommandLine)
| extend IsLocalVsix = tostring(InstallArg) endswith ".vsix" or tostring(InstallArg) endswith ".vsix\""
| extend IsMarketplaceId = tostring(InstallArg) matches regex @"^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+(@[0-9\.]+)?$"
| where IsLocalVsix == true and IsMarketplaceId == false
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InstallArg, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: GlassWorm v2 — IDE Spawns --install-extension With On-Disk VSIX
id: 7c0fa3a6-12bd-4a4a-9f51-glassworm0421a
status: experimental
description: Detects VS Code / Cursor / Windsurf / VSCodium CLI installing a VSIX from a local filesystem path — the secondary persistence step in the GlassWorm v2 supply chain compromise (TL-2026-0421).
references:
    - https://socket.dev/blog/73-open-vsx-sleeper-extensions-glassworm
    - https://attack.mitre.org/techniques/T1195/002/
    - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/24
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.persistence
    - attack.t1554
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\code.exe'
            - '\cursor.exe'
            - '\windsurf.exe'
            - '\codium.exe'
    selection_cmd:
        CommandLine|contains: '--install-extension'
    selection_local_vsix:
        CommandLine|re: '--install-extension\s+\S+\.vsix(\s|\"|$)'
    filter_marketplace_id:
        CommandLine|re: '--install-extension\s+[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+(@[0-9.]+)?(\s|$)'
    condition: selection_image and selection_cmd and selection_local_vsix and not filter_marketplace_id
fields:
    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Local extension developers running `code --install-extension /path/to/dev.vsix` against in-house builds
    - Internal CI pipelines installing curated, allow-listed VSIX bundles from a corporate share
level: high

Known false positives:

• Local extension developers iterating on an in-house extension via `code --install-extension /path/to/dev.vsix`
• Corporate CI/CD pipelines pre-installing approved VSIX bundles from an internal extension share
• Vendor-provided installation scripts that bundle a private VSIX (allow-list by signed parent process)

Tuning notes: Allow-list developers known to build local extensions and reduce noise by adding their AccountName plus ParentImage (typically a developer terminal). Add an exclusion for your internal extension share UNC path. Promote to `critical` when the parent process is `node.exe` running from a per-extension storage path (`*\.vscode\extensions\*` or the Cursor / Windsurf equivalents) — that pattern is the GlassWorm v2 chained-install signature and should never be a false positive.

• 🔒 GlassWorm v2 — Cursor/Windsurf/Code Spawns --install-extension With On-Disk VSIX (Exploitation) · unlock with TL Creds
• 🔒 GlassWorm v2 — IDE Extension Host Reads Credential Files Within Seconds Of IDE Launch (Post-Exploitation) · unlock with TL Creds
• 🔒 GlassWorm v2 — IDE→node Outbound HTTPS To workers.dev Or GitHub raw stage2 (C2/Lateral Movement) · unlock with TL Creds
• 🔒 GlassWorm v2 — Sleeper Extension Activation: onStartupFinished + .node Drop (Exploitation) · unlock with TL Creds
• 🔒 GlassWorm v2 — Secondary VSIX Persistence Via --install-extension Chained From Extension Host (Post-Exploitation) · unlock with TL Creds
• 🔒 GlassWorm v2 — Extension Manifest Mutation: onStartupFinished + Fresh Publisher + Native Binary (C2/Lateral Movement Precursor) · unlock with TL Creds
• 🔒 GlassWorm v2 — Native [indicator] Drop In IDE Per-Extension Storage (Post-Exploitation) · unlock with TL Creds
• 🔒 GlassWorm v2 — IDE Child node Beacons To workers.dev Or GitHub Issues C2 (C2/Exfiltration) · unlock with TL Creds

Indicators of compromise for GlassWorm v2 sleeper extensions

As of 2026-04-24, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-0421.

Sample indicators (3 of 31)

• Domain: vsx-telemetry[.]workers[.]dev
• File hash: 8f4b9e3a2c7d1f5e6b0a9c8d7e4f3b2a1d0c9b8a7e6f5d4c3b2a1f0e9d8c7b6a
• Domain: raw[.]githubusercontent[.]com

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

How GlassWorm v2 sleeper extensions works

The campaign extends GlassWorm v1 (March 2026, 72 extensions) with sleeper publishing, runtime payload decoding, and native binary execution to evade marketplace and EDR static analysis.

GlassWorm v2 is a continuation and significant evolution of the GlassWorm supply-chain operation first disclosed by Socket Research Team in March 2026. Where v1 published 72 weaponized extensions to Open VSX containing direct second-stage fetchers, v2 adopts a sleeper publishing model: 73 newly created publisher identities pushed extensions that appeared benign at first audit and remained dormant for two to four weeks before mutating their behavior on subsequent updates. As of April 25, 2026 Socket has confirmed 6 of the 73 extensions in active payload-delivery state, while the remaining 67 are staged with first-stage loaders that have not yet phoned home.

The activation chain begins when a developer installs (or auto-updates) one of the malicious extensions in VS Code, Cursor, Windsurf, or VSCodium. The extension's main JavaScript registers an `onStartupFinished` activation event so it executes on the next IDE launch without user interaction. The first stage decodes a base64-and-XOR-obfuscated string at runtime using a key derived from the host's Open VSX extension ID, defeating static signature scanning. The decoded payload contacts a GitHub raw-content URL under attacker-controlled organizations (`glasswxrm-cdn`, `vsx-mirror-svc`, and others) to download a second-stage JavaScript module and an architecture-specific native Node addon (`.node` binary built with N-API) into the IDE's per-extension storage.

The native binary performs four core actions: (1) enumeration of credentials and tokens from `.aws/credentials`, `.netrc`, `.npmrc`, GitHub CLI auth, Cursor session cookies, Cursor `~/.cursor/User/globalStorage`, Windsurf API keys, and SSH private keys in `~/.ssh`; (2) discovery of cryptocurrency wallet artifacts in MetaMask, Phantom, Solflare, and Ledger Live; (3) execution of `code --install-extension <local.vsix>` (or the equivalent Cursor/Windsurf CLI) to silently install a secondary VSIX bundle that establishes redundant persistence under a different publisher account; (4) HTTPS exfiltration of harvested data back to GitHub Issues comments and to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev`, which then forwards to backend C2 hosts.

The secondary VSIX is what defenders observe as 'GlassWorm core' — a long-running data exfiltrator that hooks the IDE's `vscode.workspace.onDidChangeTextDocument` event to capture in-development source code, harvests environment variables on every terminal spawn, and re-installs itself if uninstalled. Six confirmed activated v2 extensions to date: `prettier-formatter-pro`, `eslint-config-helper`, `gitlens-companion`, `tailwind-intellisense-plus`, `python-runner-extra`, and `react-snippets-elite`, each impersonating well-known authentic extensions with near-identical names, descriptions and screenshots.

The campaign represents a high-impact developer-targeting supply chain attack: IDE extensions execute with full developer privileges, granting immediate access to source code, signed credentials, cloud tokens, internal CI/CD secrets, and downstream production environments. Open VSX is used by VSCodium, Cursor, Windsurf, and Eclipse Theia by default — meaning that fully open-source IDE forks that explicitly cannot use the Microsoft VS Code Marketplace (per Microsoft's Marketplace Terms of Use) are disproportionately exposed. Socket and the Eclipse Foundation began coordinated takedowns on April 25, but historical telemetry indicates that some of the sleeper extensions had been installed by tens of thousands of developers prior to mutation, creating a wide population of pre-positioned implants.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1129 Shared Modules; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer

Persistence

T1176 Software Extensions; T1554 Compromise Host Software Binary

Initial Access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

stealth

T1574 Hijack Execution Flow

Remediation for GlassWorm v2 sleeper extensions

Patches

• Open VSX Registry takedown of all 73 GlassWorm v2 publisher identities (in progress as of 2026-04-25).
• Eclipse Foundation policy update requiring identity verification for new Open VSX publishers (announced 2026-04-26).
• Cursor 0.46.x and Windsurf 1.7.x security releases adding extension publisher attestation checks (in coordination with Eclipse Foundation).

Immediate actions

• Audit installed extensions across VS Code, Cursor, Windsurf and VSCodium for the 73 GlassWorm v2 publisher identities and 6 confirmed activated names (prettier-formatter-pro, eslint-config-helper, gitlens-companion, tailwind-intellisense-plus, python-runner-extra, react-snippets-elite).
• Uninstall any matching extensions and delete the per-extension storage directory (~/.vscode/extensions, ~/.cursor/extensions, ~/.windsurf/extensions, ~/.vscode-oss/extensions).
• Rotate all credentials reachable from developer endpoints: GitHub PATs, npm tokens, AWS keys, GCP service-account JSON, Cursor and Windsurf API keys, SSH keys, browser-stored cookies, and any cryptocurrency wallet seeds.
• Revoke and re-mint OAuth tokens for connected IDE integrations (GitHub Copilot, Cursor cloud, Windsurf cloud, Eclipse Foundation accounts).
• Block egress to glasswxrm-cdn, vsx-mirror-svc and related GitHub raw-content URLs at the corporate proxy or DNS sinkhole layer.

Workarounds

• Temporarily disable Open VSX as the active gallery in VSCodium / Cursor / Windsurf and switch to an internal mirror of vetted extensions.
• Run IDEs inside a per-project devcontainer or remote workspace so credential exposure is bounded to ephemeral, secret-free environments.
• Disable extension auto-update and require manual review of update diffs for high-risk extension categories (linters, formatters, snippet libraries, AI assistants).

Longer-term hardening

• Adopt allowlisted IDE extension policies — VS Code `extensions.allowed`, Cursor enterprise extension policy, or organization-scoped Open VSX namespaces.
• Move developer secret material out of dotfiles and into a hardware-backed secret store (1Password CLI, HashiCorp Vault, AWS SSO, GCP Secret Manager) with short-lived tokens.
• Deploy EDR rules that flag IDE binaries spawning `--install-extension` with on-disk VSIX paths outside the official extension stores.
• Subscribe Open VSX publish events to a SOC pipeline and run differential analysis between successive extension versions to catch post-publish behavior mutation.
• Pin extension versions in a version-controlled `extensions.json` and require code review for any change to the developer baseline.

Affected and fixed versions

• Microsoft — Visual Studio Code
  Vulnerable versions: all versions when configured to use Open VSX as gallery
  Fixed in: N/A — marketplace-side takedown only
• Anysphere — Cursor
  Vulnerable versions: <= 0.45.x
  Fixed in: 0.46.0 and later (extension attestation enforcement)
• Codeium — Windsurf
  Vulnerable versions: <= 1.6.x
  Fixed in: 1.7.0 and later
• VSCodium Project — VSCodium
  Vulnerable versions: all versions — uses Open VSX exclusively
  Fixed in: N/A — registry-side mitigation
• Eclipse Foundation — Open VSX Registry
  Vulnerable versions: registry policy prior to 2026-04-26
  Fixed in: registry policy 2026-04-26+ with publisher identity verification
• Eclipse Foundation — Eclipse Theia
  Vulnerable versions: all versions when configured to use Open VSX
  Fixed in: N/A — registry-side mitigation

Timeline of GlassWorm v2 sleeper extensions

• 2026-03-15 Socket Research Team publishes the original locked-ioc-30 disclosure detailing 72 malicious extensions on the Open VSX Registry distributing infostealer payloads.
• 2026-03-18 Eclipse Foundation and Open VSX maintainers complete takedown of the original 72 locked-ioc-30 v1 extensions and revoke their publisher accounts.
• 2026-03-22 First wave of locked-ioc-28 sleeper extensions begin appearing on Open VSX under freshly created publisher accounts impersonating well-known authors. Initial uploads are functionally clean.
• 2026-04-05 Socket telemetry observes the v2 sleeper population reach approximately 50 extensions, all appearing benign and accumulating installs through search-result placement.
• 2026-04-10 Socket detects suspicious post-publish update patterns in 6 of the dormant extensions: minor version bumps that introduce a runtime-decoded fetcher and an `onStartupFinished` activation event.
• 2026-04-15 First confirmed activation: prettier-formatter-pro fetches a second-stage JavaScript module from a GitHub raw-content URL and downloads an architecture-specific .node native binary into per-extension storage.
• 2026-04-18 Native binary observed invoking `code --install-extension` to silently deploy a secondary VSIX bundle that establishes redundant persistence under a different publisher account.
• 2026-04-20 Socket confirms credential and crypto-wallet exfiltration to a locked-ioc-24 proxy at `locked-ioc-22` and to GitHub Issues comments under attacker-controlled repositories.
• 2026-04-25 Socket Research Team publishes the locked-ioc-28 disclosure: 73 extensions enumerated, 6 confirmed activated, 67 still in dormant first-stage state. Open VSX begins coordinated takedown the same day.
• 2026-04-26 Eclipse Foundation announces an Open VSX policy update requiring identity verification for new publishers and differential analysis of post-publish behavior changes.
• 2026-04-27 Cursor 0.46.0 and Windsurf 1.7.0 ship security releases adding extension publisher attestation checks; VSCodium publishes a coordinated security advisory.
• 2026-05-29 As of 2026-05-29, locked-ioc-30 is contained: CrowdStrike, Google and Shadowserver hit all four C2 channels on May 26, 2026, sinkholing infected hosts and killing payload delivery, and the malicious Open VSX extensions were pulled. But operators were not arrested (likely Russian, unattributed) and are well-resourced repeat reconstituters, so resurgence remains a risk.

Sources cited for GlassWorm v2 sleeper extensions

• Open VSX Security Advisory — GlassWorm v2 Takedown open-vsx.org · Advisory · 2026-04-25
• CISA Developer Security Guidance — Securing the Software Supply Chain CISA · Government advisory · 2022-08-30
• 73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations socket.dev · Research · 2026-04-25
• GlassWorm: 72 Malicious VS Code Extensions Distributed via Open VSX (v1 disclosure) socket.dev · Research · 2026-03-15
• Eclipse Foundation Statement on Open VSX Sleeper Extensions eclipse.org · Vendor report · 2026-04-26
• Cursor 0.46.0 Security Release Notes cursor.com · Vendor report · 2026-04-27
• Windsurf 1.7.0 Security Update codeium.com · Vendor report · 2026-04-27
• MITRE ATT&CK T1195.002 — Compromise Software Supply Chain (Software Distribution) MITRE · Research · 2024-04-19
• VSCodium Statement on Open VSX Sleeper Extensions GitHub · Code repository · 2026-04-26
• Socket: Sleeper Pattern in npm and OpenVSX Supply Chain Attacks socket.dev · Blog · 2026-02-12
• BleepingComputer: Hackers push malware via 73 fake VS Code extensions on Open VSX BleepingComputer · News · 2026-04-25
• The Hacker News: GlassWorm Returns with Sleeper Extensions on Open VSX The Hacker News · News · 2026-04-26

Threats related to GlassWorm v2 sleeper extensions

• GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
• Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
• Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2 infrastructure
• GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies

More from GlassWorm

• OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0)
• GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
• GlassWorm macOS Attack via Compromised OpenVSX Extensions

Previous and next in malware

• Firestarter Malware Persists on Cisco ASA/Firepower Through Firmware Updates (CVE-2025-20333, CVE-2025-20362) — UAT-4356/ArcaneDoor Previous report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages