Supply Chain Attack Targets VS Code Extensions With ‘GlassWorm’ Malware

According to Koi Security, Visual Studio Code users were targeted in a self-propagating worm campaign named GlassWorm that spread via the OpenVSX marketplace by compromising extensions and packages. The malware hides its code using invisible Unicode variation selectors and uses a blockchain-based command-and-control infrastructure on Solana to locate its next payload, while also employing Google Calendar as a backup C&C channel.

Koi notes that the attack began on October 17, with seven OpenVSX extensions initially compromised, and that more extensions were infected as infected packages were installed by users. By October 18, ten extensions were still delivering the malware, and another was identified the next day in Microsoft’s VS Code marketplace. The infected extensions have been installed over 35,800 times, and because VS Code extensions auto-update, the compromised packages reportedly infected developers broadly. The researchers warn that the C&C infrastructure is operational and that stolen credentials are being used to compromise additional packages.