GlassWorm Returns, Slices Back into VS Code Extensions

GlassWorm, a self-propagating malware targeting Visual Studio Code extensions on the Open VSX marketplace, has apparently continued its spread despite earlier containment claims. Researchers at Koi Security reported their discovery last month, noting the worm had compromised approximately 35,800 developer machines.

The malware spreads via the Open VSX Registry, an open source marketplace for VS Code extensions run by the Eclipse Foundation, and uses printable Unicode characters that don’t render in a code editor to stay hidden. It also relies on the Solana blockchain for command and control, with Google Calendar acting as a backup C2 server.

On 6 November, Koi Security found three more infected extensions and about 10,000 additional infections, with attacker infrastructure described as mostly unchanged, according to Eclipse Foundation. The piece cites ongoing attacks and notes victims span multiple regions, including a major government entity in the Middle East. November 2025 reporting by Dark Reading emphasises that the campaign has been running for over a month and continues to spread.