GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools

According to Secure Annex, the GlassWorm supply-chain campaign has reappeared, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks such as Flutter, React, Tailwind, Vim, and Vue.

The group was first documented in October 2025, detailing its use of the Solana blockchain for command-and-control and for harvesting credentials from npm, Open VSX, GitHub, and Git, draining cryptocurrency assets and turning developer machines into attacker-controlled nodes for other criminal activity.

The latest wave, spotted by John Tuckner, again leverages stolen credentials to seed further extensions, with 24 identified extensions spread across both repositories and Rust-based implants packaged inside the extensions. In the analysed sample, Nextron Systems notes two Rust implants—os[.]node for Windows and darwin[.]node for macOS—that fetch C2 server details from a Solana wallet address to download the next-stage payload, an encrypted JavaScript file, with a Google Calendar event acting as a backup C2 address.

The attackers are also observed inflating download counts to boost trust and prioritise these malicious extensions in search results.