GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers — Threadlinqs Intelligence
As of 2026-05-30, GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers is a critical-severity malware threat attributed to GlassWorm Operators (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0421 · Severity: CRITICAL · CVSS: 9.1 · Status: MONITORING · Category: MALWARE
Attribution: GlassWorm Operators · N/A · FINANCIAL
Socket Research Team disclosed a second wave of the GlassWorm campaign on April 25, 2026: 73 malicious sleeper extensions on the Open VSX Registry impersonating legitimate VS Code add-ons, with 6
GlassWorm v2 is a continuation and significant evolution of the GlassWorm supply-chain operation first disclosed by Socket Research Team in March 2026. Where v1 published 72 weaponized extensions to Open VSX containing direct second-stage fetchers, v2 adopts a sleeper publishing model: 73 newly created publisher identities pushed extensions that appeared benign at first audit and remained dormant for two to four weeks before mutating their behavior on subsequent updates. As of April 25, 2026 Socket has confirmed 6 of the 73 extensions in active payload-delivery state, while the remaining 67 are staged with first-stage loaders that have not yet phoned home.
The activation chain begins when a developer installs (or auto-updates) one of the malicious extensions in VS Code, Cursor, Windsurf, or VSCodium. The extension's main JavaScript registers an `onStartupFinished` activation event so it executes on the next IDE launch without user interaction. The first stage decodes a base64-and-XOR-obfuscated string at runtime using a key derived from the host's Open VSX extension ID, defeating static signature scanning. The decoded payload contacts a GitHub raw-content URL under attacker-controlled organizations (`glasswxrm-cdn`, `vsx-mirror-svc`, and others) to download a second-stage JavaScript module and an architecture-specific native Node addon (`.node` binary built with N-API) into the IDE's per-extension storage.
The native binary performs four core actions: (1) enumeration of credentials and tokens from `.aws/credentials`, `.netrc`, `.npmrc`, GitHub CLI auth, Cursor session cookies, Cursor `~/.cursor/User/globalStorage`, Windsurf API keys, and SSH private keys in `~/.ssh`; (2) discovery of cryptocurrency wallet artifacts in MetaMask, Phantom, Solflare, and Ledger Live; (3) execution of `code --install-extension <local.vsix>` (or the equivalent Cursor/Windsurf CLI) to silently install a secondary VSIX bundle that establishes redundant persistence under a different publisher account; (4) HTTPS exfiltration of harvested data back to GitHub Issues comments and to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev`, which then forwards to backend C2 hosts.
The secondary VSIX is what defenders observe as 'GlassWorm core' — a long-running data exfiltrator that hooks the IDE's `vscode.workspace.onDidChangeTextDocument` event to capture in-development source code, harvests environment variables on every terminal spawn, and re-installs itself if uninstalled. Six confirmed activated v2 extensions to date: `prettier-formatter-pro`, `eslint-config-helper`, `gitlens-companion`, `tailwind-intellisense-plus`, `python-runner-extra`, and `react-snippets-elite`, each impersonating well-known authentic extensions with near-identical names, descriptions and screenshots.
The campaign represents a high-impact developer-targeting supply chain attack: IDE extensions execute with full developer privileges, granting immediate access to source code, signed credentials, cloud tokens, internal CI/CD secrets, and downstream production environments. Open VSX is used by VSCodium, Cursor, Windsurf, and Eclipse Theia by default — meaning that fully open-source IDE forks that explicitly cannot use the Microsoft VS Code Marketplace (per Microsoft's Marketplace Terms of Use) are disproportionately exposed. Socket and the Eclipse Foundation began coordinated takedowns on April 25, but historical telemetry indicates that some of the sleeper extensions had been installed by tens of thousands of developers prior to mutation, creating a wide population of pre-positioned implants.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-915, CWE-1357
Target sectors: technology, software-development, fintech, cryptocurrency, saas, open-source-projects, government-contractors, media, education
Target regions: North America, Europe, Asia-Pacific, Latin America, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.002, T1199, T1059.007, T1129, T1106, T1204.002, T1176, T1554, T1574