MalwarePublished 2 Feb 2026

Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack

Source SecurityWeek

Description

A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader. The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek .

Impact

European organizations, particularly those heavily reliant on Visual Studio Code and Open VSX extensions for software development, face risks including unauthorized access to source code, intellectual property theft, and potential lateral movement within corporate networks. The GlassWorm malware's stealth and persistence capabilities could lead to prolonged undetected compromises, data exfiltration, and disruption of development workflows. Critical infrastructure and technology firms in Europe could be targeted to gain footholds for broader cyber espionage or sabotage campaigns. The supply chain nature of this attack means that even well-secured organizations could be compromised if developers install the malicious extensions. This could undermine trust in open-source ecosystems and lead to increased operational costs due to incident response and remediation efforts.

Defensive guidance

Organizations should immediately audit their development environments for the presence of the compromised extensions and remove any suspicious versions. Developers must verify extension sources, preferring official marketplaces with stringent security controls and multi-factor authentication for publisher accounts. Implementing strict code signing and integrity verification for extensions can help detect tampering. Network monitoring should be enhanced to detect unusual outbound connections indicative of GlassWorm activity. Security teams should educate developers about supply chain risks and enforce policies restricting installation of extensions from unverified sources. Additionally, Open VSX and similar platforms must enforce stronger account security measures, including mandatory multi-factor authentication and anomaly detection for publisher accounts. Regularly updating and patching development tools and extensions is critical to reduce exposure.

References

securityweek.com/open-vsx-publisher-account-hijacked-in-fresh-glassworm-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Feb 2026, 14:14 UTC

References

Community reviews