Open VSX Downplays Impact From GlassWorm Campaign

Open VSX says the GlassWorm campaign that infected VS Code extensions in its marketplace has been fully contained, with the threat not behaving as a self-replicating worm in the traditional sense. Maintained by the Eclipse Foundation, Open VSX noted that the extensions were downloaded nearly 36,000 times and that the malware could steal credentials, drain cryptocurrency wallets, deploy SOCKS proxy servers, and install hidden VNC servers.

According to the Open VSX team, the incident was contained on October 21, and the measured impact was likely lower than initially estimated because the download count included bot downloads intended to inflate visibility. The team also revoked tokens inadvertently exposed by several extensions, explaining that exposures were caused by developer mistakes, not a compromise of the Open VSX infrastructure, and they introduced a token prefix format in collaboration with MSRC to aid detection across public repositories.

Shorter default token lifetimes, faster token revocation, and automated security scanning of all extensions at publication time were also implemented to better detect malicious code and embedded secrets from the outset.