GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers
GlassWorm v2 (TL-2026-0421), also tracked as GlassWorm v2, is a critical-severity malware campaign scored CVSS 9.1, first published 2026-04-24. It is attributed to GlassWorm Operators with low confidence, affects Microsoft Visual Studio Code, maps to 32 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0421
- Threat ID
- TL-2026-0421
- Also known as
- GlassWorm v2, GlassWorm Wave 2, Open VSX Sleeper Campaign, Operation GlassWorm
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-04-24
- Last reviewed
- 2026-04-24
- Attribution
- GlassWorm Operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, fintech, cryptocurrency, saas, open-source-projects, government-contractors, media, education
- Target regions
- North America, Europe, Asia-Pacific, Latin America, Global
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in GlassWorm v2
Malware and tooling: GlassWorm, GlassWorm v2, GitHub raw-content + Cloudflare Workers forward proxy, vsce
Socket Research Team disclosed a second wave of the GlassWorm campaign on April 25, 2026: 73 malicious sleeper extensions on the Open VSX Registry impersonating legitimate VS Code add-ons, with 6 confirmed activated and 67 still staged for trigger. Activated extensions silently fetch obfuscated second-stage JavaScript and native .node binaries from attacker-controlled GitHub repositories, then chain `--install-extension` to deploy secondary malicious VSIX bundles into VS Code, Cursor, Windsurf and VSCodium. The campaign extends GlassWorm v1 (March 2026, 72 extensions) with sleeper publishing, runtime payload decoding, and native binary execution to evade marketplace and EDR static analysis.
How GlassWorm v2 works
GlassWorm v2 is a continuation and significant evolution of the GlassWorm supply-chain operation first disclosed by Socket Research Team in March 2026. Where v1 published 72 weaponized extensions to Open VSX containing direct second-stage fetchers, v2 adopts a sleeper publishing model: 73 newly created publisher identities pushed extensions that appeared benign at first audit and remained dormant for two to four weeks before mutating their behavior on subsequent updates. As of April 25, 2026 Socket has confirmed 6 of the 73 extensions in active payload-delivery state, while the remaining 67 are staged with first-stage loaders that have not yet phoned home.
The activation chain begins when a developer installs (or auto-updates) one of the malicious extensions in VS Code, Cursor, Windsurf, or VSCodium. The extension's main JavaScript registers an `onStartupFinished` activation event so it executes on the next IDE launch without user interaction. The first stage decodes a base64-and-XOR-obfuscated string at runtime using a key derived from the host's Open VSX extension ID, defeating static signature scanning. The decoded payload contacts a GitHub raw-content URL under attacker-controlled organizations (`glasswxrm-cdn`, `vsx-mirror-svc`, and others) to download a second-stage JavaScript module and an architecture-specific native Node addon (`.node` binary built with N-API) into the IDE's per-extension storage.
The native binary performs four core actions: (1) enumeration of credentials and tokens from `.aws/credentials`, `.netrc`, `.npmrc`, GitHub CLI auth, Cursor session cookies, Cursor `~/.cursor/User/globalStorage`, Windsurf API keys, and SSH private keys in `~/.ssh`; (2) discovery of cryptocurrency wallet artifacts in MetaMask, Phantom, Solflare, and Ledger Live; (3) execution of `code --install-extension <local.vsix>` (or the equivalent Cursor/Windsurf CLI) to silently install a secondary VSIX bundle that establishes redundant persistence under a different publisher account; (4) HTTPS exfiltration of harvested data back to GitHub Issues comments and to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev`, which then forwards to backend C2 hosts.
The secondary VSIX is what defenders observe as 'GlassWorm core' — a long-running data exfiltrator that hooks the IDE's `vscode.workspace.onDidChangeTextDocument` event to capture in-development source code, harvests environment variables on every terminal spawn, and re-installs itself if uninstalled. Six confirmed activated v2 extensions to date: `prettier-formatter-pro`, `eslint-config-helper`, `gitlens-companion`, `tailwind-intellisense-plus`, `python-runner-extra`, and `react-snippets-elite`, each impersonating well-known authentic extensions with near-identical names, descriptions and screenshots.
The campaign represents a high-impact developer-targeting supply chain attack: IDE extensions execute with full developer privileges, granting immediate access to source code, signed credentials, cloud tokens, internal CI/CD secrets, and downstream production environments. Open VSX is used by VSCodium, Cursor, Windsurf, and Eclipse Theia by default — meaning that fully open-source IDE forks that explicitly cannot use the Microsoft VS Code Marketplace (per Microsoft's Marketplace Terms of Use) are disproportionately exposed. Socket and the Eclipse Foundation began coordinated takedowns on April 25, but historical telemetry indicates that some of the sleeper extensions had been installed by tens of thousands of developers prior to mutation, creating a wide population of pre-positioned implants.
MITRE ATT&CK techniques used in TL-2026-0421
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1129 Shared Modules; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer
Persistence
T1176 Software Extensions; T1554 Compromise Host Software Binary
Initial Access
T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
stealth
Affected products and versions in GlassWorm v2
- Microsoft — Visual Studio Code
Vulnerable versions: all versions when configured to use Open VSX as gallery
Fixed in: N/A — marketplace-side takedown only - Anysphere — Cursor
Vulnerable versions: <= 0.45.x
Fixed in: 0.46.0 and later (extension attestation enforcement) - Codeium — Windsurf
Vulnerable versions: <= 1.6.x
Fixed in: 1.7.0 and later - VSCodium Project — VSCodium
Vulnerable versions: all versions — uses Open VSX exclusively
Fixed in: N/A — registry-side mitigation - Eclipse Foundation — Open VSX Registry
Vulnerable versions: registry policy prior to 2026-04-26
Fixed in: registry policy 2026-04-26+ with publisher identity verification - Eclipse Foundation — Eclipse Theia
Vulnerable versions: all versions when configured to use Open VSX
Fixed in: N/A — registry-side mitigation
Remediation for GlassWorm v2
Patches
- Open VSX Registry takedown of all 73 GlassWorm v2 publisher identities (in progress as of 2026-04-25).
- Eclipse Foundation policy update requiring identity verification for new Open VSX publishers (announced 2026-04-26).
- Cursor 0.46.x and Windsurf 1.7.x security releases adding extension publisher attestation checks (in coordination with Eclipse Foundation).
Immediate actions
- Audit installed extensions across VS Code, Cursor, Windsurf and VSCodium for the 73 GlassWorm v2 publisher identities and 6 confirmed activated names (prettier-formatter-pro, eslint-config-helper, gitlens-companion, tailwind-intellisense-plus, python-runner-extra, react-snippets-elite).
- Uninstall any matching extensions and delete the per-extension storage directory (~/.vscode/extensions, ~/.cursor/extensions, ~/.windsurf/extensions, ~/.vscode-oss/extensions).
- Rotate all credentials reachable from developer endpoints: GitHub PATs, npm tokens, AWS keys, GCP service-account JSON, Cursor and Windsurf API keys, SSH keys, browser-stored cookies, and any cryptocurrency wallet seeds.
- Revoke and re-mint OAuth tokens for connected IDE integrations (GitHub Copilot, Cursor cloud, Windsurf cloud, Eclipse Foundation accounts).
- Block egress to glasswxrm-cdn, vsx-mirror-svc and related GitHub raw-content URLs at the corporate proxy or DNS sinkhole layer.
Workarounds
- Temporarily disable Open VSX as the active gallery in VSCodium / Cursor / Windsurf and switch to an internal mirror of vetted extensions.
- Run IDEs inside a per-project devcontainer or remote workspace so credential exposure is bounded to ephemeral, secret-free environments.
- Disable extension auto-update and require manual review of update diffs for high-risk extension categories (linters, formatters, snippet libraries, AI assistants).
Longer-term hardening
- Adopt allowlisted IDE extension policies — VS Code `extensions.allowed`, Cursor enterprise extension policy, or organization-scoped Open VSX namespaces.
- Move developer secret material out of dotfiles and into a hardware-backed secret store (1Password CLI, HashiCorp Vault, AWS SSO, GCP Secret Manager) with short-lived tokens.
- Deploy EDR rules that flag IDE binaries spawning `--install-extension` with on-disk VSIX paths outside the official extension stores.
- Subscribe Open VSX publish events to a SOC pipeline and run differential analysis between successive extension versions to catch post-publish behavior mutation.
- Pin extension versions in a version-controlled `extensions.json` and require code review for any change to the developer baseline.
Weaknesses (CWE) in GlassWorm v2
CWE-506, CWE-829, CWE-494, CWE-915, CWE-1357
Timeline of GlassWorm v2
- Socket Research Team publishes the original GlassWorm disclosure detailing 72 malicious extensions on the Open VSX Registry distributing infostealer payloads.
- Eclipse Foundation and Open VSX maintainers complete takedown of the original 72 GlassWorm v1 extensions and revoke their publisher accounts.
- First wave of GlassWorm v2 sleeper extensions begin appearing on Open VSX under freshly created publisher accounts impersonating well-known authors. Initial uploads are functionally clean.
- Socket telemetry observes the v2 sleeper population reach approximately 50 extensions, all appearing benign and accumulating installs through search-result placement.
- Socket detects suspicious post-publish update patterns in 6 of the dormant extensions: minor version bumps that introduce a runtime-decoded fetcher and an `onStartupFinished` activation event.
- First confirmed activation: prettier-formatter-pro fetches a second-stage JavaScript module from a GitHub raw-content URL and downloads an architecture-specific .node native binary into per-extension storage.
- Native binary observed invoking `code --install-extension` to silently deploy a secondary VSIX bundle that establishes redundant persistence under a different publisher account.
- Socket confirms credential and crypto-wallet exfiltration to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev` and to GitHub Issues comments under attacker-controlled repositories.
- Socket Research Team publishes the GlassWorm v2 disclosure: 73 extensions enumerated, 6 confirmed activated, 67 still in dormant first-stage state. Open VSX begins coordinated takedown the same day.
- Eclipse Foundation announces an Open VSX policy update requiring identity verification for new publishers and differential analysis of post-publish behavior changes.
- Cursor 0.46.0 and Windsurf 1.7.0 ship security releases adding extension publisher attestation checks; VSCodium publishes a coordinated security advisory.
- As of 2026-05-29, GlassWorm is contained: CrowdStrike, Google and Shadowserver hit all four C2 channels on May 26, 2026, sinkholing infected hosts and killing payload delivery, and the malicious Open VSX extensions were pulled. But operators were not arrested (likely Russian, unattributed) and are well-resourced repeat reconstituters, so resurgence remains a risk.
Sources cited for GlassWorm v2
- 73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations
- GlassWorm: 72 Malicious VS Code Extensions Distributed via Open VSX (v1 disclosure)
- Open VSX Security Advisory — GlassWorm v2 Takedown
- Eclipse Foundation Statement on Open VSX Sleeper Extensions
- Cursor 0.46.0 Security Release Notes
- Windsurf 1.7.0 Security Update
- VSCodium Statement on Open VSX Sleeper Extensions
- MITRE ATT&CK T1195.002 — Compromise Software Supply Chain (Software Distribution)
- CISA Developer Security Guidance — Securing the Software Supply Chain
- Socket: Sleeper Pattern in npm and OpenVSX Supply Chain Attacks
- BleepingComputer: Hackers push malware via 73 fake VS Code extensions on Open VSX
- The Hacker News: GlassWorm Returns with Sleeper Extensions on Open VSX
Threats related to GlassWorm v2
- GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
- GlassWorm Supply Chain Attack via Trojanized VS Code Extensions on Open VSX
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- Coordinated supply chain attacks on Checkmarx and Bitwarden developer tools sharing audit.checkmarx.cx C2 infrastructure
- GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
Detection coverage for TL-2026-0421
As of 2026-04-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0421 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.