Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack

A self-propagating worm, codenamed GlassWorm, is spreading via Visual Studio Code extensions on the Open VSX Registry and the Microsoft Extension Marketplace, researchers report. The campaign uses the Solana blockchain for command-and-control and a Google Calendar fallback, with the attacker relying on invisible Unicode characters to conceal malicious code in editors.

The end goal includes harvesting credentials for npm, Open VSX, GitHub and GitHub assets, draining funds from cryptocurrency wallet extensions, deploying SOCKS proxies and HVNC remote access, and weaponising stolen credentials to propagate to more packages. The first wave of infections occurred on October 17, 2025, and the infected extensions have been downloaded about 35,800 times across 13 Open VSX extensions and one Microsoft Marketplace extension.

The malicious code is written in JavaScript and aims to extract a Base64 string from memo fields on Solana transactions to reach a C2 server, with later stages introducing a Zombi module to expand the compromise. According to Idan Dardikman, the campaign shows how supply-chain malware can become a self-sustaining worm that spreads through the developer ecosystem.