GlassWorm Infiltrates VSX Extensions With 22,000+ Downloads to Target Developers
A recent supply chain attack linked to the GlassWorm group has been identified, targeting the Open VSX Registry. This attack involved a suspected compromise of legitimate publisher credentials instead of using typosquatted packages.
A recent supply chain attack linked to the GlassWorm group has been identified, targeting the Open VSX Registry. This attack involved a suspected compromise of legitimate publisher credentials instead of using typosquatted packages.
The Open VSX security team has assessed that the activity aligns with unauthorized access, such as leaked tokens, emphasizing the risk of stolen developer credentials being used to distribute malicious updates through trusted channels.
On January 30, 2026, four longstanding Open VSX extensions under the "oorzc" namespace received malicious updates embedding the GlassWorm malware loader. These extensions—FTP/SFTP/SSH Sync Tool (v0.5.1), I18n Tools (v1.6.8), vscode mindmap (v1.0.61), and scss to css (v1.3.4)—had operated legitimately for over two years, accumulating more than 22,000 downloads before the compromised releases.
Socket's analysis of download counts confirms that the total exceeds 22,000, indicating significant exposure among developers.
The malicious .vsix files contain a loader in extension.js that uses AES-256-CBC encryption to decrypt an embedded hex-encoded blob, which is executed at runtime. This method conceals the payload from static inspection, with its logic only becoming visible in memory.
A recent supply chain attack linked to the GlassWorm group has been identified, targeting the Open VSX Registry.
The initial payload stage conducts environment checks to avoid infecting Russian and adjacent systems, using locale, time zone, and UTC offset as indicators. Systems matching these criteria are skipped, reflecting typical operational security measures.
If the host passes these checks, the payload retrieves its next-stage configuration from Solana blockchain transaction memos, allowing dynamic changes in command-and-control infrastructure without republishing the extension. The loader is primarily focused on macOS systems, checking for the Darwin operating system before executing Stage 2.
Stage 2, a Node.js JavaScript implant, is designed for data theft and persistence on macOS developer endpoints. It creates a working directory under /tmp/ijewf, aggregates sensitive data, compresses it into /tmp/out.zip, and exfiltrates it via curl to IP-based endpoints. The data collection scope includes browser cookies, login databases, wallet-extension data, and more.
The implant also targets developer-related secrets, such as ~/.aws credentials and ~/.ssh keys, increasing the risk of cloud account takeover and lateral movement within enterprise environments. It inspects npm configuration for _authToken values and references GitHub authentication artifacts, potentially allowing attackers to hijack private repositories or push tampered releases.
This attack represents a shift from previous GlassWorm campaigns, which relied on typosquatting. The current incident involved an established publisher account with a significant history and adoption signals. The "oorzc" publisher also maintains Visual Studio Marketplace listings, suggesting that a trusted identity was targeted.
Socket's findings focus on the Open VSX ecosystem, with no indication that Visual Studio Marketplace listings were compromised. Following the disclosure on January 30, 2026, the Eclipse Foundation/Open VSX Registry security team removed the malicious releases, deactivated associated tokens, and removed all versions of oorzc.ssh-tools from the registry while preserving clean versions of the other extensions.
This response highlights the speed and limitations of registry-side defenses. Once developer credentials are compromised, trusted distribution paths can be misused until detection and token revocation occur.
Based on reporting by GBHackers.