New GlassWorm Threat Uses Stealthy Code to Target OpenVSX Extensions

According to GBHackers on Security, GlassWorm is the world’s first self-propagating worm targeting OpenVSX extensions, with its discovery traced to 17 October 2025. The threat hijacks developer machines by embedding malicious JavaScript in VS Code extension packages using invisible Unicode variation selectors, leaving a near-impossible footprint for standard code review.

In the compromised CodeJoy extension (version 1.8.3), hundreds of blank lines conceal executable code that static scanners and human reviewers tend to ignore. Once activated, GlassWorm contacts the Solana blockchain for command-and-control instructions, reading memo fields from recent transactions to fetch payloads, and it also uses a Google Calendar event title as a backup C2 channel.

The worm’s final stage, the ZOMBI module, provides a fully fledged remote access trojan, enabling concealed SOCKS proxies, WebRTC control channels, BitTorrent-based command distribution, and HVNC sessions. Seven OpenVSX extensions have been compromised, with over 35,800 downloads, and ten extensions still distributing GlassWorm at the time of writing; two authors have clean updates, while five compromised projects await remediation.

Enterprises are urged to audit extensions, revoke credentials, rotate tokens, and deploy advanced behavioural monitoring to detect hidden Unicode payloads and unusual network activity.