GLASSWORM has evolved to hide in dependencies, with researchers noting a shift to transitive loader delivery that uses extensionPack and extensionDependencies to deliver its payload. According to Socket's research team, malicious listings can appear harmless at first because the loader is connected through an extension rather than being embedded in the package itself, broadening the threat actor’s reach.
In a report published on 13 March 2026, Socket identified 72 malicious Open VSX extensions linked to the GlassWorm campaign, many of which impersonate widely used developer extensions to trick users. The malware previously targeted credentials across NPM, GitHub, and Git, along with other sensitive data, and now relies on transitive installation paths to obscure the true malicious component.
Defenders are urged to audit extension chains and look for indicators such as staged loaders, Russian gating, and Solana memo lookups, as GlassWorm moves toward less visible, more resilient delivery.