In April 2026, security researchers identified over 70 cloned extensions on the Open VSX marketplace that are linked to the GlassWorm malware campaign. GlassWorm first appeared in October 2025 and targets GitHub, Git, and NPM credentials, as well as cryptocurrency. The cloned extensions mimic legitimate ones in appearance but are published by newly created GitHub accounts with minimal activity. These extensions initially appear benign but are designed as sleeper agents to deliver malware through updates. The malware employs obfuscation techniques such as Unicode variation selectors and uses the Solana blockchain for command-and-control. Delivery methods include bundled native binaries and remote payload downloads, complicating detection efforts.

The GlassWorm-linked cloned extensions pose a risk of credential theft (GitHub, Git, NPM), sensitive data compromise, and cryptocurrency theft. By impersonating trusted extensions, they increase the likelihood of user installation and subsequent infection. The malware's use of multiple evasion and delivery techniques makes detection and prevention more challenging. At least six extensions have already been activated, indicating active exploitation potential. The threat affects users of the Open VSX extension marketplace and potentially other open source software ecosystems.

No official patch or remediation is indicated for the Open VSX extensions themselves. Users should avoid installing extensions from untrusted or newly created publishers, especially those with minimal GitHub activity or suspicious naming patterns. Monitoring for updates to installed extensions and verifying publisher authenticity can reduce risk. Security teams should be aware of the GlassWorm campaign's tactics and consider additional endpoint protections to detect unusual extension behavior. Patch status is not yet confirmed — check vendor advisories and Open VSX marketplace updates for current remediation guidance.