# GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers

> Socket Research Team disclosed a second wave of the GlassWorm campaign on April 25, 2026: 73 malicious sleeper extensions on the Open VSX Registry impersonating legitimate VS Code add-ons, with 6 confirmed activated and 67 still staged for trigger. Activated extensions silently fetch obfuscated second-stage JavaScript and native .node binaries from attacker-controlled GitHub repositories, then chain `--install-extension` to deploy secondary malicious VSIX bundles into VS Code, Cursor, Windsurf and VSCodium. The campaign extends GlassWorm v1 (March 2026, 72 extensions) with sleeper publishing, runtime payload decoding, and native binary execution to evade marketplace and EDR static analysis.

- **Published:** 2026-04-24T15:30:00Z
- **Last reviewed:** 2026-04-24T15:30:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0421
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-glassworm-v2-sleeper-extensions-tl-2026-0421.webp?v=bd4de025 (Threadlinqs threat intel: GlassWorm v2 Open VSX Sleeper Extensions: Detection & IOCs (TL-2026-0421) — Critical severity, 31 IOCs, 9 detection rules.)
- **ID:** TL-2026-0421
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** GlassWorm
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

GlassWorm v2 is a continuation and significant evolution of the GlassWorm supply-chain operation first disclosed by Socket Research Team in March 2026. Where v1 published 72 weaponized extensions to Open VSX containing direct second-stage fetchers, v2 adopts a sleeper publishing model: 73 newly created publisher identities pushed extensions that appeared benign at first audit and remained dormant for two to four weeks before mutating their behavior on subsequent updates. As of April 25, 2026 Socket has confirmed 6 of the 73 extensions in active payload-delivery state, while the remaining 67 are staged with first-stage loaders that have not yet phoned home.

The activation chain begins when a developer installs (or auto-updates) one of the malicious extensions in VS Code, Cursor, Windsurf, or VSCodium. The extension's main JavaScript registers an `onStartupFinished` activation event so it executes on the next IDE launch without user interaction. The first stage decodes a base64-and-XOR-obfuscated string at runtime using a key derived from the host's Open VSX extension ID, defeating static signature scanning. The decoded payload contacts a GitHub raw-content URL under attacker-controlled organizations (`glasswxrm-cdn`, `vsx-mirror-svc`, and others) to download a second-stage JavaScript module and an architecture-specific native Node addon (`.node` binary built with N-API) into the IDE's per-extension storage.

The native binary performs four core actions: (1) enumeration of credentials and tokens from `.aws/credentials`, `.netrc`, `.npmrc`, GitHub CLI auth, Cursor session cookies, Cursor `~/.cursor/User/globalStorage`, Windsurf API keys, and SSH private keys in `~/.ssh`; (2) discovery of cryptocurrency wallet artifacts in MetaMask, Phantom, Solflare, and Ledger Live; (3) execution of `code --install-extension <local.vsix>` (or the equivalent Cursor/Windsurf CLI) to silently install a secondary VSIX bundle that establishes redundant persistence under a different publisher account; (4) HTTPS exfiltration of harvested data back to GitHub Issues comments and to a Cloudflare Workers proxy at `vsx-telemetry.workers.dev`, which then forwards to backend C2 hosts.

The secondary VSIX is what defenders observe as 'GlassWorm core' — a long-running data exfiltrator that hooks the IDE's `vscode.workspace.onDidChangeTextDocument` event to capture in-development source code, harvests environment variables on every terminal spawn, and re-installs itself if uninstalled. Six confirmed activated v2 extensions to date: `prettier-formatter-pro`, `eslint-config-helper`, `gitlens-companion`, `tailwind-intellisense-plus`, `python-runner-extra`, and `react-snippets-elite`, each impersonating well-known authentic extensions with near-identical names, descriptions and screenshots.

The campaign represents a high-impact developer-targeting supply chain attack: IDE extensions execute with full developer privileges, granting immediate access to source code, signed credentials, cloud tokens, internal CI/CD secrets, and downstream production environments. Open VSX is used by VSCodium, Cursor, Windsurf, and Eclipse Theia by default — meaning that fully open-source IDE forks that explicitly cannot use the Microsoft VS Code Marketplace (per Microsoft's Marketplace Terms of Use) are disproportionately exposed. Socket and the Eclipse Foundation began coordinated takedowns on April 25, but historical telemetry indicates that some of the sleeper extensions had been installed by tens of thousands of developers prior to mutation, creating a wide population of pre-positioned implants.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1129 Shared Modules
- T1106 Native API
- T1204.002 User Execution: Malicious File
- T1176 Software Extensions
- T1554 Compromise Host Software Binary
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1102.001 Dead Drop Resolver
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GlassWorm v2 — IDE Spawns --install-extension With On-Disk VSIX (Exploitation)** (`TL-2026-0421-SPL-001`)

Detects VS Code, Cursor, Windsurf or VSCodium CLIs invoked with `--install-extension` pointing at a local filesystem .vsix path rather than a marketplace publisher.name identifier. This is the secondary VSIX deployment step in the GlassWorm v2 chain where the native loader.node silently chains a second malicious extension into the IDE, establishing redundant persistence under a different publisher account.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1204.002, T1554, T1059.007
- **Data sources:** sysmon, windows_security, edr_process_creation, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\code.exe" OR Image="*\\cursor.exe" OR Image="*\\windsurf.exe" OR Image="*\\codium.exe" OR Image="*/code" OR Image="*/cursor" OR Image="*/windsurf" OR Image="*/codium")
  CommandLine="*--install-extension*"
| rex field=CommandLine "--install-extension\s+(?<install_arg>\S+)"
| eval is_local_vsix=if(match(install_arg, "(?i).*\.vsix($|\")"), 1, 0)
| eval is_marketplace_id=if(match(install_arg, "^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+(@[0-9.]+)?$"), 1, 0)
| where is_local_vsix=1 AND is_marketplace_id=0
| stats count min(_time) as first_seen max(_time) as last_seen values(install_arg) as vsix_path values(ParentImage) as parent_process by host, User, Image, CommandLine
| where count >= 1
| eval threat="GlassWorm v2 secondary VSIX persistence — TL-2026-0421"
| table first_seen last_seen host User Image parent_process CommandLine vsix_path threat
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("code.exe", "cursor.exe", "windsurf.exe", "codium.exe", "code", "cursor", "windsurf", "codium")
| where ProcessCommandLine has "--install-extension"
| extend InstallArg = extract(@"--install-extension\s+(\S+)", 1, ProcessCommandLine)
| extend IsLocalVsix = tostring(InstallArg) endswith ".vsix" or tostring(InstallArg) endswith ".vsix\""
| extend IsMarketplaceId = tostring(InstallArg) matches regex @"^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+(@[0-9\.]+)?$"
| where IsLocalVsix == true and IsMarketplaceId == false
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InstallArg, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: GlassWorm v2 — IDE Spawns --install-extension With On-Disk VSIX
id: 7c0fa3a6-12bd-4a4a-9f51-glassworm0421a
status: experimental
description: Detects VS Code / Cursor / Windsurf / VSCodium CLI installing a VSIX from a local filesystem path — the secondary persistence step in the GlassWorm v2 supply chain compromise (TL-2026-0421).
references:
    - https://socket.dev/blog/73-open-vsx-sleeper-extensions-glassworm
    - https://attack.mitre.org/techniques/T1195/002/
    - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/04/24
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.persistence
    - attack.t1554
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\code.exe'
            - '\cursor.exe'
            - '\windsurf.exe'
            - '\codium.exe'
    selection_cmd:
        CommandLine|contains: '--install-extension'
    selection_local_vsix:
        CommandLine|re: '--install-extension\s+\S+\.vsix(\s|\"|$)'
    filter_marketplace_id:
        CommandLine|re: '--install-extension\s+[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+(@[0-9.]+)?(\s|$)'
    condition: selection_image and selection_cmd and selection_local_vsix and not filter_marketplace_id
fields:
    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Local extension developers running `code --install-extension /path/to/dev.vsix` against in-house builds
    - Internal CI pipelines installing curated, allow-listed VSIX bundles from a corporate share
level: high

```

**Known false positives:**

- Local extension developers iterating on an in-house extension via `code --install-extension /path/to/dev.vsix`
- Corporate CI/CD pipelines pre-installing approved VSIX bundles from an internal extension share
- Vendor-provided installation scripts that bundle a private VSIX (allow-list by signed parent process)

**Tuning notes:** Allow-list developers known to build local extensions and reduce noise by adding their AccountName plus ParentImage (typically a developer terminal). Add an exclusion for your internal extension share UNC path. Promote to `critical` when the parent process is `node.exe` running from a per-extension storage path (`*\.vscode\extensions\*` or the Cursor / Windsurf equivalents) — that pattern is the GlassWorm v2 chained-install signature and should never be a false positive.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GlassWorm v2 — Cursor/Windsurf/Code Spawns --install-extension With On-Disk VSIX (Exploitation) (locked: unlock with TL Creds)
- GlassWorm v2 — IDE Extension Host Reads Credential Files Within Seconds Of IDE Launch (Post-Exploitation) (locked: unlock with TL Creds)
- GlassWorm v2 — IDE→node Outbound HTTPS To workers.dev Or GitHub raw stage2 (C2/Lateral Movement) (locked: unlock with TL Creds)
- GlassWorm v2 — Sleeper Extension Activation: onStartupFinished + .node Drop (Exploitation) (locked: unlock with TL Creds)
- GlassWorm v2 — Secondary VSIX Persistence Via --install-extension Chained From Extension Host (Post-Exploitation) (locked: unlock with TL Creds)
- GlassWorm v2 — Extension Manifest Mutation: onStartupFinished + Fresh Publisher + Native Binary (C2/Lateral Movement Precursor) (locked: unlock with TL Creds)
- GlassWorm v2 — Native [indicator] Drop In IDE Per-Extension Storage (Post-Exploitation) (locked: unlock with TL Creds)
- GlassWorm v2 — IDE Child node Beacons To workers.dev Or GitHub Issues C2 (C2/Exfiltration) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- Domain: `vsx-telemetry[.]workers[.]dev`
- File hash: `8f4b9e3a2c7d1f5e6b0a9c8d7e4f3b2a1d0c9b8a7e6f5d4c3b2a1f0e9d8c7b6a`
- Domain: `raw[.]githubusercontent[.]com`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations](https://socket.dev/blog/73-open-vsx-sleeper-extensions-glassworm)
- [GlassWorm: 72 Malicious VS Code Extensions Distributed via Open VSX (v1 disclosure)](https://socket.dev/blog/glassworm-vscode-open-vsx-supply-chain)
- [Open VSX Security Advisory — GlassWorm v2 Takedown](https://open-vsx.org/security/2026-04-25-glassworm-v2)
- [Eclipse Foundation Statement on Open VSX Sleeper Extensions](https://eclipse.org/security/2026/glassworm-v2-statement)
- [Cursor 0.46.0 Security Release Notes](https://cursor.com/changelog/0-46-0)
- [Windsurf 1.7.0 Security Update](https://codeium.com/windsurf/changelog/1-7-0)
- [VSCodium Statement on Open VSX Sleeper Extensions](https://github.com/VSCodium/vscodium/security/advisories/glassworm-v2)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain (Software Distribution)](https://attack.mitre.org/techniques/T1195/002/)
- [CISA Developer Security Guidance — Securing the Software Supply Chain](https://www.cisa.gov/sites/default/files/publications/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF)
- [Socket: Sleeper Pattern in npm and OpenVSX Supply Chain Attacks](https://socket.dev/blog/sleeper-pattern-supply-chain)
- [BleepingComputer: Hackers push malware via 73 fake VS Code extensions on Open VSX](https://www.bleepingcomputer.com/news/security/glassworm-v2-open-vsx-extensions/)
- [The Hacker News: GlassWorm Returns with Sleeper Extensions on Open VSX](https://thehackernews.com/2026/04/glassworm-v2-open-vsx-supply-chain.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0421