MalwarePublished 21 Oct 2025Updated 20 Nov 2025

GlassWorm: Self-Propagating VSCode Extension Worm

Source AlienVault OTX General

Description

GlassWorm is a groundbreaking self-propagating worm targeting VS Code extensions on OpenVSX marketplace. It employs invisible Unicode characters to conceal malicious code and utilizes a blockchain-based command and control infrastructure on Solana. The worm compromised seven OpenVSX extensions with 35,800 downloads, harvesting NPM, GitHub, and Git credentials, targeting cryptocurrency wallets, deploying SOCKS proxy servers, and installing hidden VNC servers. It spreads exponentially through the developer ecosystem using stolen credentials. The worm employs a triple-layer C2 setup involving Solana blockchain, direct IP connection, and Google Calendar. A new infected extension was also detected in Microsoft's VSCode marketplace. The campaign remains active, necessitating immediate security measures and audits of installed extensions.

Impact

For European organizations, GlassWorm poses a multifaceted threat. The compromise of developer credentials can lead to unauthorized access to proprietary source code, intellectual property theft, and insertion of backdoors or malicious code into software products, potentially affecting software supply chains across Europe. The targeting of cryptocurrency wallets may result in direct financial losses for individuals and organizations involved in crypto transactions. The deployment of SOCKS proxies and hidden VNC servers can facilitate lateral movement within corporate networks, espionage, and data exfiltration. Given the widespread use of VSCode and its extensions among European developers, the worm's self-propagation mechanism could rapidly increase infection rates, impacting software development integrity and operational continuity. The presence of infected extensions on both OpenVSX and Microsoft's marketplace broadens the attack surface, increasing the likelihood of exposure. Additionally, the worm's use of blockchain and cloud services for C2 complicates detection and mitigation efforts, potentially allowing prolonged undetected presence within networks. This threat could undermine trust in open-source and third-party software repositories, affecting software development practices and supply chain security in Europe.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat. First, conduct comprehensive audits of all installed VSCode extensions, verifying their provenance and checking for recent updates or unusual behaviors. Employ static and dynamic analysis tools capable of detecting obfuscated code, including invisible Unicode characters. Restrict the installation of extensions to those from verified, trusted sources and consider using allowlists rather than blacklists. Implement credential hygiene best practices: enforce multi-factor authentication (MFA) on all developer accounts (NPM, GitHub, Git), rotate credentials regularly, and monitor for credential leaks or unauthorized access. Network monitoring should focus on detecting unusual outbound connections, especially to known malicious IPs or domains associated with the worm’s C2 infrastructure, including Solana blockchain nodes and suspicious Google Calendar API usage. Deploy endpoint detection and response (EDR) solutions with behavioral analytics to identify SOCKS proxy deployments and hidden VNC servers. Educate developers about the risks of installing unverified extensions and the importance of reporting suspicious activity. Finally, collaborate with marketplace providers to report and remove malicious extensions promptly and participate in threat intelligence sharing within the European cybersecurity community.

Indicators of compromise

URLs 2

http://217.69.3.218/get_zombi_payload/qQD%2FJoi3WCWSk8ggGHiTdg%3D%3D
http://217.69.3.218/get_arhive_npm/

IP addresses 1

CC=FR ASN=AS20473 the constant company llc

140.82.52.31

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Oct 2025, 19:43 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

URLs 2

IP addresses 1

Community reviews

Related threats