Cybersecurity researchers have uncovered a new wave of malicious Visual Studio Code-compatible extensions on the Open VSX marketplace, linked to a persistent information-stealing campaign known as GlassWorm.
According to Socket, the latest cluster includes 73 impersonation extensions connected to GlassWorm activity. At least six have already been confirmed as malicious, while many others appear to be “sleeper” extensions — packages that look harmless at first, gain trust and downloads, and can later be updated to deliver malware.
What Is GlassWorm?
GlassWorm is a software supply chain malware campaign targeting developers through malicious or compromised extensions used in coding environments.
The campaign focuses on tools commonly used by developers, including:
- 🧑💻 VS Code
- 🌀 Cursor
- 🌊 Windsurf
- 🧩 VSCodium
- 📦 Open VSX-based extension ecosystems
The latest activity, tracked as GlassWorm v2, shows that the attackers are evolving beyond simple malicious extensions. They are now using cloned packages, sleeper extensions, transitive dependencies, and secondary VSIX payloads to make detection harder.
73 Fake Extensions Found on Open VSX
The newly identified extensions are cloned versions of legitimate tools. They copy familiar names, icons, descriptions, and README content to create what researchers call visual trust.
This is a simple but effective social engineering tactic. A developer browsing quickly may see a familiar icon, similar wording, and a believable extension name — and install it without noticing the publisher mismatch or typo.
Socket highlighted one example where an impersonation extension closely mirrored Microsoft’s Turkish language pack listing, using similar branding and copied content while appearing under a different publisher namespace.
Confirmed Malicious Extensions
The following six extensions have been identified as malicious in the latest reporting:
outsidestormcommand.monochromator-theme
keyacrosslaud.auto-loop-for-antigravity
krundoven.ironplc-fast-hub
boulderzitunnel.vscode-buddies
cubedivervolt.html-code-validate
winnerdomain17.version-lens-tool
These packages are part of a broader set of more than 320 GlassWorm-related artifacts identified since December 21, 2025, according to public reporting citing Socket’s research.
Sleeper Packages: The Dangerous New Tactic
One of the most concerning parts of this campaign is the use of sleeper extensions.
A sleeper extension may not contain obvious malware when it is first published. Instead, it appears clean and useful, giving it time to collect installs and build credibility. Later, the attacker can push an update that adds malicious logic or pulls in another malicious dependency.
This makes one-time review ineffective.
A package that looked safe during installation can become dangerous after an update.
Socket previously reported that GlassWorm actors have abused VS Code manifest features, such as extensionPack and extensionDependencies, allowing one extension to trigger the installation of another GlassWorm-linked component.
How the Malware Chain Works
The latest GlassWorm activity does not always place the final payload directly inside the visible extension.
Instead, the malicious extension may act as a loader.
The chain can look like this:
- 🧩 Developer installs a cloned or sleeper extension
- 🔄 Extension activates or updates later
- 🌐 Loader retrieves a secondary VSIX payload from GitHub
- 🖥️ Payload installs across supported IDEs
- 🕸️ Malware steals data, deploys a RAT, and adds rogue browser components
Researchers reported that the malware can install a secondary VSIX extension into multiple IDEs on the same machine, including VS Code, Cursor, Windsurf, and VSCodium, using the --install-extension command.
What GlassWorm Tries to Steal
The goal of GlassWorm is to compromise developer environments and steal valuable data.
Targeted data can include:
- 🔑 developer credentials
- 🧾 API keys and access tokens
- 🧬 GitHub, Git, npm, and Open VSX-related secrets
- 🌐 browser credentials and bookmarks
- 💰 cryptocurrency wallet data
- 🖥️ system access through remote access tooling
Public reporting also notes that GlassWorm variants have avoided systems using Russian locale or timezone settings, a pattern seen in several malware campaigns.
Why Developers Are a High-Value Target
Developers are especially attractive to attackers because their machines often contain access to source code, build systems, cloud environments, deployment pipelines, package registries, and internal credentials.
Compromising one developer workstation can potentially give attackers a route into:
- ☁️ cloud infrastructure
- 📦 software supply chains
- 🏗️ CI/CD pipelines
- 🔐 secrets and tokens
- 🧑💼 customer or production environments
This is why malicious IDE extensions are so dangerous. They run inside trusted development tools and may have access to files, terminals, environment variables, repositories, and credentials.
How Developers Can Protect Themselves
Developers should treat extensions as part of the software supply chain.
Recommended actions:
- ✅ Install extensions only from trusted publishers
- ✅ Check publisher names carefully, not only icons and descriptions
- ✅ Be suspicious of typos, copied branding, and low-reputation publishers
- ✅ Remove extensions you do not actively use
- ✅ Review recently installed Open VSX extensions
- ✅ Disable automatic extension updates where practical
- ✅ Monitor for unexpected
--install-extensionactivity - ✅ Rotate exposed tokens if compromise is suspected
- ✅ Check GitHub, npm, cloud, and package registry access logs
For higher-risk environments, teams should consider maintaining an approved extension allowlist.
Recommendations for Security Teams
Security and DevOps teams should not treat IDE extensions as harmless productivity tools. They are executable components inside developer workstations.
Practical controls include:
- 🧩 Create an approved extension baseline
- 🔍 Audit installed extensions across developer machines
- 🚫 Block known malicious extension IDs
- 📊 Monitor unusual outbound traffic from IDE processes
- 🔐 Rotate developer secrets after suspected exposure
- 🛑 Restrict installation of unapproved extensions
- 🧪 Add extension review to software supply chain security checks
- 📦 Monitor package registries and GitHub repositories for suspicious changes
The key lesson from GlassWorm v2 is that extension risk is no longer limited to the moment of installation. Updates and dependency relationships must also be monitored.
Final Thoughts
GlassWorm v2 shows how quickly software supply chain attacks are evolving.
Attackers are no longer relying only on obviously malicious packages. They are building trust first, cloning legitimate extensions, using familiar icons, and weaponizing updates later.
For developers, the warning is clear: 🧩 Your IDE is part of your attack surface.
Every extension installed into a development environment should be treated like code from a third-party dependency. If it can run inside your editor, it can potentially access sensitive files, credentials, repositories, and systems.
In modern software security, protecting the developer workstation is just as important as protecting production.
