GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)

Key facts for GlassWorm developer worm

Detection coverage for GlassWorm developer worm

As of 2026-05-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0603 across Splunk SPL, Microsoft KQL and Sigma, covering 49 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GlassWorm C2 — Solana Dead-Drop / WebSocket Tasking / /wall Exfil to GlassWorm VPS

Detects three GlassWorm C2 patterns in network telemetry: (1) HTTP POST to public Solana RPC endpoints carrying the known dead-drop wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 or getSignaturesForAddress, (2) outbound connections to the four GlassWorm staging/exfil IPs (217.69.3.218, 199.247.10.166, 140.82.52.31, 199.247.13.106), or (3) WebSocket/HTTP requests to /get_arhive_npm/, /get_zombi_payload/, or /wall paths.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1102.001, T1102.002, T1090.002, T1041, T1567
• Data sources: zeek, proxy, firewall, mde_network, palo_alto
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=zeek OR index=firewall sourcetype IN ("zeek:http","bro:http:json","zeek:conn","stream:http","pan:traffic") earliest=-24h
| eval ioc_match=case(
    match(dest_ip, "^(217\.69\.3\.218|199\.247\.10\.166|140\.82\.52\.31|199\.247\.13\.106)$"), "glassworm_vps",
    match(uri_path, "(?i)(/get_arhive_npm/|/get_zombi_payload/|/wall$)"), "glassworm_endpoint",
    match(http_host, "(?i)(api\.mainnet-beta\.solana\.com|solana-api\.projectserum\.com|rpc\.ankr\.com/solana|solana-mainnet\.g\.alchemy\.com)") AND (match(http_request_body, "28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2") OR match(http_request_body, "getSignaturesForAddress")), "glassworm_solana_deaddrop",
    match(uri_full, "(?i)calendar\.app\.google/M2ZCvM8ULL56PD1d6"), "glassworm_gcal_deaddrop",
    1=1, null())
| where isnotnull(ioc_match)
| eval c2_channel=ioc_match
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ips values(uri_path) as uris values(http_host) as hosts by src_ip, src_host, c2_channel
| eval threat="GlassWorm C2", severity="critical"
| table _time src_host src_ip c2_channel dest_ips hosts uris count first_seen last_seen threat severity

Microsoft KQL

let glassworm_ips = dynamic(["217.69.3.218","199.247.10.166","140.82.52.31","199.247.13.106"]);
let glassworm_paths = dynamic(["/get_arhive_npm/","/get_zombi_payload/","/wall"]);
let solana_hosts = dynamic(["api.mainnet-beta.solana.com","solana-api.projectserum.com","rpc.ankr.com","solana-mainnet.g.alchemy.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Code.exe","Cursor.exe","Windsurf.exe","Positron.exe","VSCodium.exe","node.exe","electron.exe","chrome.exe","msedge.exe","brave.exe","arc.exe")
| extend Channel = case(
    RemoteIP in (glassworm_ips), "glassworm_vps",
    RemoteUrl has_any (glassworm_paths), "glassworm_endpoint",
    RemoteUrl has_any (solana_hosts), "glassworm_solana_candidate",
    RemoteUrl has "calendar.app.google/M2ZCvM8ULL56PD1d6", "glassworm_gcal_deaddrop",
    "")
| where Channel != ""
| join kind=leftouter (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "BrowserLaunchedToOpenUrl" or ActionType == "ConnectionInspected"
    | where AdditionalFields has "28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2" or AdditionalFields has "getSignaturesForAddress"
    | project DeviceId, SolanaWalletSeen = true
) on DeviceId
| extend Channel = iff(Channel == "glassworm_solana_candidate" and SolanaWalletSeen == true, "glassworm_solana_deaddrop", Channel)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, Protocol, Channel
| extend Threat = "GlassWorm C2", Severity = "critical"

Sigma

title: GlassWorm C2 Beacon — Solana Dead-Drop, WebSocket RAT, or /wall Exfil
id: 9f6c5a31-1aaa-4b0d-9d2c-9e9c0bf90603
status: experimental
description: Detects GlassWorm command-and-control traffic in three flavors — (1) HTTP POST to a public Solana RPC endpoint whose body references the known dead-drop wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 or getSignaturesForAddress, (2) outbound TCP/HTTP to the four GlassWorm staging/exfil VPS IPs, or (3) requests to the GlassWorm /get_arhive_npm/, /get_zombi_payload/, or /wall URI paths. Originated by VS Code / Cursor / Windsurf / Node / Electron processes.
references:
    - https://thehackernews.com/2026/05/glassworm-malware-takedown-disrupts.html
    - https://www.koi.ai/incident/live-updates-glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-and-vscode-marketplaces
    - https://securityaffairs.com/184427/malware/glassworm-malware-has-resurfaced-on-the-open-vsx-registry.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/27
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102.001
    - attack.t1102.002
    - attack.t1090.002
    - attack.exfiltration
    - attack.t1041
    - attack.t1567
logsource:
    category: proxy
detection:
    selection_ip:
        dst_ip:
            - '217.69.3.218'
            - '199.247.10.166'
            - '140.82.52.31'
            - '199.247.13.106'
    selection_path:
        cs-uri-stem|contains:
            - '/get_arhive_npm/'
            - '/get_zombi_payload/'
            - '/wall'
    selection_solana_host:
        cs-host|contains:
            - 'api.mainnet-beta.solana.com'
            - 'solana-api.projectserum.com'
            - 'rpc.ankr.com'
            - 'solana-mainnet.g.alchemy.com'
    selection_solana_body:
        cs-uri-query|contains:
            - '28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2'
            - 'getSignaturesForAddress'
    selection_gcal:
        cs-uri-stem|contains: '/M2ZCvM8ULL56PD1d6'
    condition: selection_ip or selection_path or (selection_solana_host and selection_solana_body) or selection_gcal
falsepositives:
    - Legitimate Solana developer tooling on developer endpoints (filter on wallet address — GlassWorm wallet is unique)
    - Security researchers reproducing IOCs in lab environments
level: critical

Known false positives:

• Legitimate Solana developer tooling — filter on wallet address (the wallet is unique to GlassWorm)
• Researchers reproducing IOCs in lab

Tuning notes: Critical-severity alert on first hit — these IOCs are unambiguous post-takedown. Enrich with TLS JA3/JA4 fingerprints for the WebSocket RAT once captured. Geofence the four VPS IPs to perimeter-block instead of detect-only once confirmed in your environment.

• 🔒 GlassWorm Exploitation — VS Code / Cursor / Windsurf Spawning Shell or Downloader · unlock with TL Creds
• 🔒 GlassWormRAT Post-Exploitation — Developer Credential File Access (.npmrc / gh hosts.yml / OpenVSX token / Git credentials) · unlock with TL Creds
• 🔒 GlassWorm ZOMBI Module — SOCKS5 / Hidden VNC / WebRTC / BitTorrent DHT from Developer Endpoint · unlock with TL Creds
• 🔒 GlassWorm Exploitation — Trojanized Marketplace Extension Install (Known IOC Package Names) · unlock with TL Creds
• 🔒 GlassWormRAT macOS LaunchAgent Persistence + Chromium Unpacked Extension Sideload · unlock with TL Creds
• 🔒 GlassWorm Lateral Movement — AI-Generated Malicious Commits via Stolen GitHub Token · unlock with TL Creds
• 🔒 GlassWorm Exploitation — Invisible Unicode Variation Selectors in VS Code Extension JS · unlock with TL Creds
• 🔒 GlassWorm Post-Exploitation — HKCU/HKLM Run Key Persistence by VS Code Descendant · unlock with TL Creds

Indicators of compromise for GlassWorm developer worm

As of 2026-05-27, Threadlinqs Intelligence tracks 49 indicators of compromise for TL-2026-0603.

Sample indicators (3 of 49)

• IP address: 217.69.3[.]218
• Domain: calendar[.]app[.]google
• IP address: 199.247.10[.]166

Defanged, TLP:CLEAR. Full set of 49 indicators: unlock with TL Creds.

How GlassWorm developer worm works

Its payload, GlassWormRAT, is a WebSocket-based JavaScript RAT that pivots into the ZOMBI module — turning developer hosts into SOCKS / Hidden VNC / WebRTC proxy infrastructure — and deploys a Chrome extension for screenshot, keystroke, and clipboard capture.

GlassWorm is a self-propagating supply chain worm first publicly disclosed by Koi Security on 2025-10-18 after the actor compromised 7 OpenVSX extensions on 2025-10-17 (later expanded to 13 OpenVSX + 1 VS Code Marketplace extension `cline-ai-main.cline-ai-agent` v3.1.3 on 2025-10-19; ~35,800 cumulative installations) and resurfaced on 2025-11-06 with three more OpenVSX extensions (`ai-driven-dev.ai-driven-dev`, `adhamu.history-in-sublime-merge`, `yasuyuky.transient-emacs`; ~10,000 installations).

**Invisible-code stealth.** The worm hides its bootstrap in invisible Unicode variation selectors injected into otherwise benign-looking JavaScript inside the extension's `extension.js`. To a human reviewer or static scanner the malicious line renders as whitespace; the V8 / Node interpreter, however, executes it verbatim. This is the first observed weaponization of Unicode variation selectors as a packer for marketplace extensions.

**Four-channel resilient C2.** GlassWorm operators built a deliberately redundant C2 stack so that no single takedown could disable the botnet:

1. **Solana blockchain (primary discovery channel)** — Wallet `28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2` issues SPL transactions whose `memo` instruction field contains the current C2 URL. The malware queries a public Solana RPC endpoint, walks the wallet's transaction list, and decodes the most recent memo to obtain a fresh staging URL. Three known config-update transactions (`49CDiVWZpu…`, `3eVTqgEVdU…`, `3v3jCvKfdv…`) were observed between 2025-10-15 and 2025-11-06. 2. **Google Calendar dead drop** — Public calendar `https://calendar.app.google/M2ZCvM8ULL56PD1d6` owned by `uhjdclolkdn@gmail.com`. Event titles encode fallback C2 URLs. Removed during the takedown after coordination with Google's Threat Analysis Group. 3. **BitTorrent DHT** — The ZOMBI module joins the public Mainline DHT and uses peer announce / get_peers traffic against attacker-controlled info-hashes as a covert configuration channel. Disrupted by Shadowserver via DHT sinkholing. 4. **Commercial VPS** — Direct hardcoded fallback servers `217.69.3.218` and `199.247.10.166` (BL Networks / Vultr ranges) serving the second-stage archive at `/get_arhive_npm/` and `/get_zombi_payload/<base64>`. Exfiltration sinks on `140.82.52.31:80/wall` and `199.247.13.106:80/wall`.

**GlassWormRAT (Stage 2).** A WebSocket-based JavaScript RAT loaded from `http://217.69.3.218/get_arhive_npm/` after the bootstrap decodes the Solana memo. It establishes a wss:// session for live tasking and exposes commands for credential harvesting (NPM `~/.npmrc`, GitHub PATs from `gh` config and OS keyring, OpenVSX publisher tokens, Git credential helper, environment variables), crypto-wallet theft against 49 known browser extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Solflare, Backpack, Keplr, Rabby, OKX, Brave Wallet, etc.), and lateral repo compromise — using the stolen GitHub credentials to push AI-generated, plausibly-worded malicious commits into 300+ repos starting 2025-10-31.

**ZOMBI module (Stage 3).** Final payload that converts the workstation into multi-protocol proxy infrastructure. ZOMBI fuses four sub-components: (a) a SOCKS5 server bound to a high port and tunneled out-bound to the C2; (b) Hidden VNC giving operators a full desktop session indistinguishable from the user's; (c) WebRTC peer routing for NAT traversal and P2P remote-execution; (d) BitTorrent DHT participation for resilient discovery. The resulting botnet was sold/used as a residential-proxy and malware-distribution backbone.

**Chrome extension implant.** GlassWormRAT side-loads an unpacked Chromium extension into developer profiles (Chrome, Brave, Edge, Arc) granting it `tabs`, `scripting`, `storage`, and `<all_urls>` host permissions. It exfiltrates full-page screenshots on tab change, keystrokes via injected content-scripts, and clipboard contents on every focus event — yielding 2FA codes, password-manager autofill, and recovery seeds.

**Persistence.** Run keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run` re-launch the bootstrap; on macOS a LaunchAgent plist is dropped in `~/Library/LaunchAgents`. The Chrome extension itself acts as a soft persistence layer because it survives RAT removal.

**Attribution.** Multiple independent indicators point to a Russian-speaking actor: (a) Cyrillic comments in deobfuscated bootstrap, (b) malware self-terminates if `GetUserDefaultLangID()` / `Intl.DateTimeFormat().resolvedOptions().locale` falls inside the CIS bloc (RU, BY, KZ, UZ, AZ, AM, KG, TJ, MD, TM), (c) RedExt-family panel artefacts observed on the staging VPS, (d) victimology that excludes Russian-language repositories. Attribution confidence: MEDIUM (no formal nation-state nexus established; consistent with financially-motivated Russian-speaking crimeware crew with side ESPIONAGE tasking against a Middle Eastern government victim disclosed in November 2025).

**Takedown (2026-05-27).** CrowdStrike Counter Adversary Operations led the operation: Solana wallet activity was monitored and a poisoned config transaction was broadcast to redirect remaining beacons to sinkholes; Google TAG terminated `uhjdclolkdn@gmail.com` and the public calendar; Shadowserver sinkholed the BitTorrent DHT info-hashes and the two VPS subnets; OpenVSX and the VS Code Marketplace pulled all known malicious versions and rotated publisher tokens. Despite the disruption defenders should treat all developer credentials touched by an affected workstation as compromised — the worm's self-propagation guarantees dormant secondary infections in private repos and CI pipelines.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1497.001 Virtualization/Sandbox Evasion: System Checks

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Credential Access

T1056.001 Input Capture: Keylogging; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1090.002 Proxy: External Proxy; T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.002 Encrypted Channel: Asymmetric Cryptography

Collection

T1113 Screen Capture; T1115 Clipboard Data

Persistence

T1176 Software Extensions; T1543.001 Create or Modify System Process: Launch Agent; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Initial Access

T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Discovery

T1217 Browser Information Discovery; T1518 Software Discovery

Impact

T1496 Resource Hijacking

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

discovery

T1614.001 System Location Discovery: System Language Discovery

Remediation for GlassWorm developer worm

Immediate actions

• Audit installed VS Code / Cursor / Windsurf / Positron / VSCodium extensions against the published GlassWorm extension+version list and uninstall any match
• Block egress to 217.69.3.218, 199.247.10.166, 140.82.52.31, 199.247.13.106 at perimeter and EDR firewall
• Block resolution of calendar.app.google/M2ZCvM8ULL56PD1d6 and alert on any process touching the path
• Revoke and rotate all GitHub PATs, npm publish tokens, OpenVSX publisher tokens, and SSH keys present on any developer workstation that installed an affected extension
• Force-rotate every secret committed to any GitHub repo touched by an affected developer between 2025-10-15 and 2026-05-27
• Treat all browser-stored credentials and crypto-wallet seeds on affected hosts as compromised — restore wallets from offline seed and transfer funds
• Remove the unauthorized Chromium extension by deleting unmanaged extensions in chrome://extensions and clearing Default/Extensions in the user profile

Workarounds

• Temporarily disable the OpenVSX gallery in VS Code forks and revert to first-party Microsoft Marketplace with Verified Publisher filter until ecosystem-wide invisible-Unicode scanning is in place
• Run developer workstations under a non-admin user with AppLocker / Gatekeeper blocking writes to Run keys and LaunchAgents

Longer-term hardening

• Enforce signed extensions only and pin allow-listed publishers via VS Code policy (`extensions.autoUpdate=false`, `extensions.allowed`)
• Deploy EDR rules for child processes of Code.exe / cursor.exe spawning powershell/curl/wget or making WebSocket connections to non-corporate hosts
• Require hardware-backed (FIDO2/Passkey) authentication for GitHub, npm, and OpenVSX publish operations
• Move npm/PyPI/OpenVSX traffic through an internal proxy/mirror that performs invisible-Unicode scanning and dependency provenance checks (Sigstore, npm provenance)
• Introduce a Chrome / Edge enterprise policy that blocks unpacked / developer-mode extension loads on developer endpoints
• Implement Solana memo-field monitoring for known malicious wallet families in network detection stack

Affected and fixed versions

• Eclipse Foundation — Open VSX Registry
  Vulnerable versions: all (publisher-token theft based)
  Fixed in: malicious extension versions removed 2025-10-18 onward; tokens rotated 2026-05-27
• Microsoft — Visual Studio Code Marketplace
  Vulnerable versions: cline-ai-main.cline-ai-agent 3.1.3
  Fixed in: malicious version removed 2025-10-19
• Microsoft — Visual Studio Code
  Vulnerable versions: all consuming affected extensions
  Fixed in: uninstall affected extensions
• Anysphere — Cursor
  Vulnerable versions: all consuming affected OpenVSX extensions
  Fixed in: uninstall affected extensions
• Codeium — Windsurf
  Vulnerable versions: all consuming affected OpenVSX extensions
  Fixed in: uninstall affected extensions
• Posit — Positron
  Vulnerable versions: all consuming affected OpenVSX extensions
  Fixed in: uninstall affected extensions
• VSCodium Project — VSCodium
  Vulnerable versions: all consuming affected OpenVSX extensions
  Fixed in: uninstall affected extensions
• OpenJS Foundation — npm registry packages
  Vulnerable versions: unspecified packages compromised via stolen publisher tokens
  Fixed in: affected packages identified by npm security; rotate all developer tokens
• Python Software Foundation — PyPI packages
  Vulnerable versions: unspecified packages compromised via stolen publisher tokens
  Fixed in: audit PyPI publishes by affected maintainers; rotate API tokens
• GitHub — Repositories (300+)
  Vulnerable versions: repos owned by affected developer accounts 2025-10-31 through 2026-05-27
  Fixed in: force-rotate tokens; audit commits from affected developers

Timeline of GlassWorm developer worm

• 2025-10-15 First locked-ioc-45 config-update Solana transaction broadcast from wallet 28PKnu7RzizxBzFPoLp69HLXp9bJL3JFtT2s5QzHsEA2 pointing to staging VPS locked-ioc-42.
• 2025-10-17 Seven OpenVSX extensions trojanized with invisible-Unicode bootstrap; ~35,800 total downloads across the affected versions.
• 2025-10-18 Koi Security publishes the first locked-ioc-45 disclosure — the first observed self-propagating worm in the VS Code / OpenVSX ecosystem and first weaponization of Unicode variation selectors as marketplace payload packer.
• 2025-10-19 Microsoft VS Code Marketplace extension cline-ai-main.cline-ai-agent v3.1.3 confirmed infected; six additional OpenVSX extensions identified, bringing the public IOC list to 13 OpenVSX + 1 Marketplace extension.
• 2025-10-31 Stolen GitHub tokens used to push AI-generated malicious commits into 300+ third-party repositories, bootstrapping a parallel propagation channel independent of the marketplaces.
• 2025-11-06 locked-ioc-45 resurfaces on OpenVSX with three new infected extensions (locked-ioc-35, locked-ioc-28, locked-ioc-36) — ~10,000 additional downloads. Same exfil VPS, Solana wallet updated to new C2 URL.
• 2025-11-15 Keylogger telemetry recovered from a sinkholed beacon identifies a major Middle Eastern government entity among locked-ioc-45 victims; victimology suggests opportunistic capture rather than targeted operation.
• 2026-02-10 CrowdStrike Counter Adversary Operations, Google Threat Analysis Group, and Shadowserver Foundation begin coordinated tracking of the locked-ioc-45 botnet for joint disruption.
• 2026-05-27 Coordinated takedown announced: Solana wallet beacons redirected to sinkhole, Google Calendar dead drop terminated, BitTorrent DHT info-hashes sinkholed by Shadowserver, VPS C2 servers (locked-ioc-42 / locked-ioc-40) and exfil sinks (locked-ioc-43 / locked-ioc-41) null-routed; marketplaces purge remaining malicious versions and rotate publisher tokens.
• 2026-05-29 As of 2026-05-29, the May 26-27 CrowdStrike/Google/Shadowserver takedown disrupted all four locked-ioc-45 C2 channels but neutralized infrastructure only — no arrests, the Russian-based operators remain at large and capable of reconstituting. Stolen developer credentials, 300+ poisoned repos, and dormant sleeper infections stay a live concern, keeping it MONITORING not RESOLVED.

Sources cited for GlassWorm developer worm

• First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace koi.ai · Research · 2025-10-18
• Live Updates: GlassWorm, First Self-Propagating Worm Using Invisible Code Hits OpenVSX And VSCode Marketplaces koi.ai · Research · 2025-10-19
• GlassWorm — Self-Propagating VSCode Extension Worm truesec.com · Vendor report · 2025-10-22
• GlassWorm: The First Self-Propagating VS Code Extension Worm veracode.com · Vendor report · 2025-10-23
• Defending Against GlassWorm: The Invisible Malware That's Rewriting Supply Chain Security snyk.io · Vendor report · 2025-10-24
• Detecting GlassWorm with YARA Rules knostic.ai · Research · 2025-10-25
• GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure The Hacker News · News · 2026-05-27
• Self-Propagating GlassWorm Attacks VS Code Supply Chain Dark Reading · News · 2025-10-20
• Supply Chain Attack Targets VS Code Extensions With GlassWorm Malware SecurityWeek · News · 2025-10-21
• GlassWorm Malware Has Resurfaced on the Open VSX Registry securityaffairs.com · News · 2025-11-07
• Self-Propagating Worm Found in Marketplaces for Visual Studio Code Extensions infoworld.com · News · 2025-10-22

Threats related to GlassWorm developer worm

• GlassWorm Supply Chain Campaign: 73 Malicious Open VSX Extensions Using Transitive Dependencies
• GlassWorm v2 — 73 Open VSX Sleeper Extensions Activate Supply Chain Malware Against VS Code, Cursor, Windsurf and VSCodium Developers
• GlassWorm v3 Supply Chain Attack — 72 Malicious Open VSX Extensions, 151 GitHub Repos & ZOMBI Botnet Module
• Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")

Related coverage of this activity

• TrapDoor crypto stealer

More from GlassWorm

• OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0)
• GlassWASM: TinyGo WebAssembly Malware in Open VSX Extensions Using Solana Blockchain Dead-Drop C2 (GlassWorm Successor)
• GlassWorm macOS Attack via Compromised OpenVSX Extensions

Previous and next in supply chain

• durabletask PyPI Supply Chain Compromise (v1.4.1–1.4.3) — Microsoft-Published Azure Durable Functions SDK Trojanized w/ Cross-Cloud Credential Stealer + Linux Disk Wiper (TeamPCP / Mini Shai-Hulud) Previous report
• forge-jsxy npm Supply Chain RAT — 22 Versions in 22 Days with Crypto Wallet Theft, WebRTC P2P Exfil & Cross-Platform Persistent Backdoor (OSV MAL-2026-3609, SafeDep) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages