GlassWorm Malware Returns to Open VSX, Emerges on GitHub

The GlassWorm malware has reappeared in the Open VSX registry, two weeks after being removed from the Visual Studio Code extensions marketplace, according to Koi Security. After landing in Open VSX earlier, three more infected VS Code extensions were discovered in the registry on November 6, with a combined download count of approximately 10,000.

The attackers pushed a new Solana blockchain transaction to feed new C&C addresses to the malware to download a next-stage payload, while the exfiltration server remained unchanged from the first wave. Open VSX said in late October that the attack had been contained within days and that additional security measures had been implemented to prevent similar attacks, and that all infected extensions were removed from the registry, with the incident considered contained as of October 21.

The campaign continues to spread, with a threat actor reportedly using Unicode variation selectors to hide code, and evidence suggesting the same group is behind both the Open VSX and GitHub attacks, according to Aikido Security.