GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers

GlassWorm v2 (TL-2026-0421), also tracked as GlassWorm v2, is a critical-severity malware campaign scored CVSS 9.1, first published 2026-04-24. It is attributed to GlassWorm Operators with low confidence, affects Microsoft Visual Studio Code, maps to 32 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-0421

Threat ID
TL-2026-0421
Also known as
GlassWorm v2, GlassWorm Wave 2, Open VSX Sleeper Campaign, Operation GlassWorm
Severity
CRITICAL
CVSS
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
MALWARE
First published
2026-04-24
Last reviewed
2026-04-24
Attribution
GlassWorm Operators
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, fintech, cryptocurrency, saas, open-source-projects, government-contractors, media, education
Target regions
North America, Europe, Asia-Pacific, Latin America, Global
Detection rules
9
Indicators of compromise
31

Malware and tooling in GlassWorm v2

Malware and tooling: GlassWorm, GlassWorm v2, GitHub raw-content + Cloudflare Workers forward proxy, vsce

Socket Research Team disclosed a second wave of the GlassWorm campaign on April 25, 2026: 73 malicious sleeper extensions on the Open VSX Registry impersonating legitimate VS Code add-ons, with 6 confirmed activated and 67 still staged for trigger. Activated extensions silently fetch obfuscated second-stage JavaScript and native .node binaries from attacker-controlled GitHub repositories, then chain `--install-extension` to deploy secondary malicious VSIX bundles into VS Code, Cursor, Windsurf and VSCodium. The campaign extends GlassWorm v1 (March 2026, 72 extensions) with sleeper publishing, runtime payload decoding, and native binary execution to evade marketplace and EDR static analysis.

How GlassWorm v2 works

GlassWorm v2 is a continuation and significant evolution of the GlassWorm supply-chain operation first disclosed by Socket Research Team in March 2026. Where v1 published 72 weaponized extensions to Open VSX containing direct second-stage fetchers, v2 adopts a sleeper publishing model: 73 newly created publisher identities pushed extensions that appeared benign at first audit and remained dormant for two to four weeks before mutating their behavior on subsequent updates. As of April 25, 2026 Socket has confirmed 6 of the 73 extensions in active payload-delivery state, while the remaining 67 are staged with first-stage loaders that have not yet phoned home.

The activation chain begins when a developer installs (or auto-updates) one of the malicious extensions in VS Code, Cursor, Windsurf, or VSCodium. The extension's main JavaScript registers an `onStartupFinished` activation event so it executes on the next IDE launch without user interaction. The first stage decodes a base64-and-XOR-obfuscated string at runtime using a key derived from the host's Open VSX extension ID, defeating static signature scanning. The decoded payload contacts a GitHub raw-content URL under attacker-controlled organizations (`glasswxrm-cdn`, `vsx-mirror-svc`, and others) to download a second-stage JavaScript module and an architecture-specific native Node addon (`.node` binary built with N-API) into the IDE's per-extension storage.

The native binary performs four core actions: (1) enumeration of credentials and tokens from `.aws/credentials`, `.netrc`, `.npmrc`, GitHub CLI auth, Cursor session cookies, Cursor `~/.cursor/User/globalStorage`, Windsurf API keys, and SSH private keys in `~/.ssh`; (2) discovery of cryptocurrency wallet artifacts in MetaMask, Phantom, Solflare, and Ledger Live; (3) execution of `code --install-extension <local.vsix>` (or the equivalent Cursor/Windsurf CLI) to silently install a secondary VSIX bundle that establishes redundant persistence under a different publisher account; (4) HTTPS exfiltration of harvested data back to GitHub Issues comments and to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev`, which then forwards to backend C2 hosts.

The secondary VSIX is what defenders observe as 'GlassWorm core' — a long-running data exfiltrator that hooks the IDE's `vscode.workspace.onDidChangeTextDocument` event to capture in-development source code, harvests environment variables on every terminal spawn, and re-installs itself if uninstalled. Six confirmed activated v2 extensions to date: `prettier-formatter-pro`, `eslint-config-helper`, `gitlens-companion`, `tailwind-intellisense-plus`, `python-runner-extra`, and `react-snippets-elite`, each impersonating well-known authentic extensions with near-identical names, descriptions and screenshots.

The campaign represents a high-impact developer-targeting supply chain attack: IDE extensions execute with full developer privileges, granting immediate access to source code, signed credentials, cloud tokens, internal CI/CD secrets, and downstream production environments. Open VSX is used by VSCodium, Cursor, Windsurf, and Eclipse Theia by default — meaning that fully open-source IDE forks that explicitly cannot use the Microsoft VS Code Marketplace (per Microsoft's Marketplace Terms of Use) are disproportionately exposed. Socket and the Eclipse Foundation began coordinated takedowns on April 25, but historical telemetry indicates that some of the sleeper extensions had been installed by tens of thousands of developers prior to mutation, creating a wide population of pre-positioned implants.

MITRE ATT&CK techniques used in TL-2026-0421

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1129 Shared Modules; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer

Persistence

T1176 Software Extensions; T1554 Compromise Host Software Binary

Initial Access

T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

stealth

T1574 Hijack Execution Flow

Affected products and versions in GlassWorm v2

  • Microsoft — Visual Studio Code
    Vulnerable versions: all versions when configured to use Open VSX as gallery
    Fixed in: N/A — marketplace-side takedown only
  • Anysphere — Cursor
    Vulnerable versions: <= 0.45.x
    Fixed in: 0.46.0 and later (extension attestation enforcement)
  • Codeium — Windsurf
    Vulnerable versions: <= 1.6.x
    Fixed in: 1.7.0 and later
  • VSCodium Project — VSCodium
    Vulnerable versions: all versions — uses Open VSX exclusively
    Fixed in: N/A — registry-side mitigation
  • Eclipse Foundation — Open VSX Registry
    Vulnerable versions: registry policy prior to 2026-04-26
    Fixed in: registry policy 2026-04-26+ with publisher identity verification
  • Eclipse Foundation — Eclipse Theia
    Vulnerable versions: all versions when configured to use Open VSX
    Fixed in: N/A — registry-side mitigation

Remediation for GlassWorm v2

Patches

  • Open VSX Registry takedown of all 73 GlassWorm v2 publisher identities (in progress as of 2026-04-25).
  • Eclipse Foundation policy update requiring identity verification for new Open VSX publishers (announced 2026-04-26).
  • Cursor 0.46.x and Windsurf 1.7.x security releases adding extension publisher attestation checks (in coordination with Eclipse Foundation).

Immediate actions

  • Audit installed extensions across VS Code, Cursor, Windsurf and VSCodium for the 73 GlassWorm v2 publisher identities and 6 confirmed activated names (prettier-formatter-pro, eslint-config-helper, gitlens-companion, tailwind-intellisense-plus, python-runner-extra, react-snippets-elite).
  • Uninstall any matching extensions and delete the per-extension storage directory (~/.vscode/extensions, ~/.cursor/extensions, ~/.windsurf/extensions, ~/.vscode-oss/extensions).
  • Rotate all credentials reachable from developer endpoints: GitHub PATs, npm tokens, AWS keys, GCP service-account JSON, Cursor and Windsurf API keys, SSH keys, browser-stored cookies, and any cryptocurrency wallet seeds.
  • Revoke and re-mint OAuth tokens for connected IDE integrations (GitHub Copilot, Cursor cloud, Windsurf cloud, Eclipse Foundation accounts).
  • Block egress to glasswxrm-cdn, vsx-mirror-svc and related GitHub raw-content URLs at the corporate proxy or DNS sinkhole layer.

Workarounds

  • Temporarily disable Open VSX as the active gallery in VSCodium / Cursor / Windsurf and switch to an internal mirror of vetted extensions.
  • Run IDEs inside a per-project devcontainer or remote workspace so credential exposure is bounded to ephemeral, secret-free environments.
  • Disable extension auto-update and require manual review of update diffs for high-risk extension categories (linters, formatters, snippet libraries, AI assistants).

Longer-term hardening

  • Adopt allowlisted IDE extension policies — VS Code `extensions.allowed`, Cursor enterprise extension policy, or organization-scoped Open VSX namespaces.
  • Move developer secret material out of dotfiles and into a hardware-backed secret store (1Password CLI, HashiCorp Vault, AWS SSO, GCP Secret Manager) with short-lived tokens.
  • Deploy EDR rules that flag IDE binaries spawning `--install-extension` with on-disk VSIX paths outside the official extension stores.
  • Subscribe Open VSX publish events to a SOC pipeline and run differential analysis between successive extension versions to catch post-publish behavior mutation.
  • Pin extension versions in a version-controlled `extensions.json` and require code review for any change to the developer baseline.

Weaknesses (CWE) in GlassWorm v2

CWE-506, CWE-829, CWE-494, CWE-915, CWE-1357

Timeline of GlassWorm v2

  • Socket Research Team publishes the original GlassWorm disclosure detailing 72 malicious extensions on the Open VSX Registry distributing infostealer payloads.
  • Eclipse Foundation and Open VSX maintainers complete takedown of the original 72 GlassWorm v1 extensions and revoke their publisher accounts.
  • First wave of GlassWorm v2 sleeper extensions begin appearing on Open VSX under freshly created publisher accounts impersonating well-known authors. Initial uploads are functionally clean.
  • Socket telemetry observes the v2 sleeper population reach approximately 50 extensions, all appearing benign and accumulating installs through search-result placement.
  • Socket detects suspicious post-publish update patterns in 6 of the dormant extensions: minor version bumps that introduce a runtime-decoded fetcher and an `onStartupFinished` activation event.
  • First confirmed activation: prettier-formatter-pro fetches a second-stage JavaScript module from a GitHub raw-content URL and downloads an architecture-specific .node native binary into per-extension storage.
  • Native binary observed invoking `code --install-extension` to silently deploy a secondary VSIX bundle that establishes redundant persistence under a different publisher account.
  • Socket confirms credential and crypto-wallet exfiltration to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev` and to GitHub Issues comments under attacker-controlled repositories.
  • Socket Research Team publishes the GlassWorm v2 disclosure: 73 extensions enumerated, 6 confirmed activated, 67 still in dormant first-stage state. Open VSX begins coordinated takedown the same day.
  • Eclipse Foundation announces an Open VSX policy update requiring identity verification for new publishers and differential analysis of post-publish behavior changes.
  • Cursor 0.46.0 and Windsurf 1.7.0 ship security releases adding extension publisher attestation checks; VSCodium publishes a coordinated security advisory.
  • As of 2026-05-29, GlassWorm is contained: CrowdStrike, Google and Shadowserver hit all four C2 channels on May 26, 2026, sinkholing infected hosts and killing payload delivery, and the malicious Open VSX extensions were pulled. But operators were not arrested (likely Russian, unattributed) and are well-resourced repeat reconstituters, so resurgence remains a risk.

Sources cited for GlassWorm v2

Threats related to GlassWorm v2

Detection coverage for TL-2026-0421

As of 2026-04-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0421 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats