Security researchers have discovered dozens of malicious Open VSX extensions linked to the GlassWorm malware campaign, targeting software developers and their environments.
GlassWorm focuses on stealing developer credentials and sensitive data, which attackers then use to publish poisoned packages and extensions, spreading the malware further across the software supply chain.
🎯 Targets include:
• GitHub, NPM, and Git credentials
• Cryptocurrency wallets
• Browser data and VPN configurations
• macOS keychain and system data
A new evolution of GlassWorm makes it harder to detect by hiding malicious loaders through dependency-based extensions, meaning an extension may look legitimate while secretly installing malware through linked packages.
⚠️ Key takeaway: Developer tooling ecosystems have become a major malware distribution channel, making supply chain security more critical than ever.
Organizations should regularly audit extensions, review dependency chains, and monitor unusual extension updates.
