GlassWorm Malware Returns with 73 OpenVSX Sleeper Extensions in New Supply Chain Attack

A sophisticated malware campaign has resurfaced through 73 seemingly benign OpenVSX extensions that activate malicious payloads after updates, targeting developer environments and crypto wallets.

A new wave of the GlassWorm malware campaign has been identified targeting the OpenVSX ecosystem with 73 "sleeper" extensions that remain benign initially but deliver malicious payloads after updates. Security researchers at Socket have discovered that six of these extensions have already been activated, while the remaining 67 are assessed as either dormant or suspicious.

The attackers have refined their approach compared to earlier iterations, submitting extensions that appear harmless at first but introduce malicious code through subsequent updates. This strategy allows the malicious code to bypass initial security screenings and remain undetected for longer periods.

"This count may change as new updates continue to appear, but the pattern is consistent with earlier GlassWorm waves," researchers at Socket noted in their analysis. The campaign represents a significant evolution in supply chain attacks against developer ecosystems.

Background on the GlassWorm Campaign

GlassWorm was first observed in October 2025, initially using invisible Unicode characters to hide malicious code designed to steal cryptocurrency wallets and developer credentials. Since its inception, the campaign has expanded across multiple ecosystems, including GitHub repositories, npm packages, and both the Visual Studio Code Marketplace and OpenVSX.

The attackers have also demonstrated cross-platform capabilities, targeting macOS users with trojanized crypto wallet clients. A particularly concerning wave in mid-March 2026 affected hundreds of repositories and dozens of extensions, drawing attention from multiple research teams who helped block the activity early.

The New Strategy: Sleeper Extensions

The latest wave suggests a strategic shift by the attackers. Rather than embedding malicious code in extensions from the start, they now submit initially benign extensions and introduce the payload in subsequent updates. This approach reduces the risk of detection during the initial submission process and extends the window of opportunity for infections.

Socket researchers found that the 73 extensions involved in this campaign are clones of legitimate listings, designed to trick developers who might not scrutinize beyond visual appearances. In one case, the attacker used identical icons, similar naming conventions, and comparable descriptions to the legitimate extension. The primary indicators of malicious intent are the publisher name and unique identifier.

Technical Analysis of the Malicious Payloads

While the extensions themselves don't contain the initial malware, they act as thin loaders that fetch malicious code through several methods:

Secondary Package Retrieval: The extensions fetch a secondary VSIX package from GitHub at runtime and install it using CLI commands.
Compiled Module Loading: Some extensions load platform-specific compiled modules (.node files) that contain the core logic, including fetching additional payloads and executing installation routines across supported editors.
Obfuscated JavaScript: Other variants rely heavily on obfuscated JavaScript that decodes at runtime to fetch and install malicious extensions. These often include encrypted or fallback URLs for payload retrieval.

The cybersecurity company has not disclosed technical details about the newest payloads, but previous GlassWorm attacks have focused on stealing cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data.

Implications for Developer Security

This campaign highlights critical vulnerabilities in extension marketplaces and the challenges of maintaining security in open development ecosystems. The "sleeper" approach presents a particular challenge because it bypasses static analysis tools that examine code at submission time.

Developers should be vigilant about:

Verifying the publisher identity before installing extensions
Monitoring installed extensions for unexpected updates
Implementing strict controls on extension permissions
Regularly auditing installed extensions for suspicious behavior

Socket has published the full list of the 73 extensions believed to be part of the latest GlassWorm wave. Developers who have installed any of these extensions are strongly advised to rotate all secrets, revoke access tokens, and thoroughly clean their development environments.

Broader Security Landscape

The GlassWorm campaign exists within a concerning trend of increasingly sophisticated supply chain attacks targeting developer ecosystems. Recent incidents include a macOS stealer campaign using Script Editor in ClickFix attacks, the Infinity Stealer malware targeting macOS systems, and the Torg Grabber infostealer targeting 728 crypto wallets.

As development ecosystems continue to grow and interconnect, the potential impact of such campaigns expands proportionally. The security community must develop more dynamic approaches to threat detection that can identify malicious behavior patterns rather than just static code signatures.

The return of GlassWorm with this refined approach demonstrates that attackers are continuously adapting their methods, making it essential for developers, platform providers, and security researchers to maintain constant vigilance and improve detection capabilities against these evolving threats.

For developers seeking to enhance their security posture, resources like the OpenVSX security guidelines and Microsoft's secure development practices provide valuable frameworks for protecting development environments.