Self-Propagating GlassWorm Attacks VS Code Supply Chain

A self-propagating worm called GlassWorm is targeting Visual Studio Code extensions in a sophisticated supply-chain attack that has infected 35,800 developer machines so far. Researchers at Koi Security flagged the malware on 18 October after the CodeJoy extension on the OpenVSX marketplace, an open-source alternative to the Visual Studio Marketplace, exhibited suspicious behaviour.

An investigation found that the extension carried an unusually stealthy malware that renders itself invisible to a code editor, with the researchers calling the code “invisible” rather than obfuscated. The campaign uses the Solana blockchain as its command-and-control channel and Google Calendar as a backup C2 server, harvesting credentials from NPM, GitHub, and OpenVSX to propagate to more packages and extensions.

According to Idan Dardikman, Koi’s CTO and co-founder, the worm also deploys SOCKS proxies and can install hidden VNC servers, turning infected developer workstations into nodes in a criminal infrastructure network; three extensions infected on 17 October remain active, while four have been updated to a clean version.