New GlassWorm Threat Uses Stealthy Code to Target OpenVSX Extensions

GlassWorm is a newly identified self-propagating worm targeting Visual Studio Code (VS Code) extensions within the OpenVSX marketplace. This worm employs advanced techniques to deliver invisible malicious payloads, making detection and mitigation challenging.

GlassWorm was first identified on Tue, Oct 17, 2025. It exploits invisible Unicode code to infiltrate developer machines, gaining unauthorized access to credentials and cryptocurrency wallets. The worm also converts infected systems into proxy nodes for illicit activities. Its command-and-control (C2) infrastructure leverages blockchain technology and Google Calendar, making it resilient to traditional countermeasures.

The worm employs unprintable Unicode variation selectors to conceal malicious JavaScript within VS Code extension packages, leaving no visible trace in the Integrated Development Environment (IDE) or code diffs. For example, the compromised CodeJoy extension (version 1.8.3) contains executable code hidden within seemingly blank lines of source code.

Upon activation, GlassWorm communicates with the Solana blockchain to receive C2 instructions. It monitors transactions from a specific wallet address, extracting payload links encoded in transaction memos. This decentralized approach ensures that the C2 infrastructure remains operational and immune to takedowns. Additionally, alternate payload URLs are embedded in Google Calendar event titles, exploiting legitimate services to evade network restrictions.

The final stage of GlassWorm, called the ZOMBI module, provides comprehensive remote access capabilities. Infected systems:

Function as concealed SOCKS proxy servers, facilitating anonymous routing of malicious traffic. Incorporate WebRTC modules to establish peer-to-peer control channels, bypassing NAT and firewall constraints. Utilize BitTorrent's Distributed Hash Table (DHT) network for decentralized command distribution. Set up hidden Virtual Network Computing (VNC) sessions in virtual desktops, granting attackers covert access.

The worm continues to spread across the OpenVSX and Microsoft VS Code marketplaces, affecting seven extensions with over 35,800 downloads. Despite mitigation efforts by some developers, GlassWorm's presence persists, highlighting vulnerabilities in existing security measures.

Developers are advised to conduct immediate audits of their installed VS Code extensions, revoke and rotate credentials, and implement advanced behavioral monitoring systems capable of detecting hidden Unicode payloads and abnormal network activity. As the open-source community faces evolving threats, enhancing security measures is crucial to safeguarding the integrity of development pipelines.

GlassWorm's emergence underscores the need for robust defenses against increasingly sophisticated software supply chain attacks. Traditional measures such as manual code review and signature-based detection are insufficient against such advanced threats.

Based on reporting by GBHackers.