On January 30, 2026, threat actors executed a supply chain attack against the Open VSX Registry by compromising the publishing credentials of a legitimate developer known as 'oorzc'. This allowed them to push malicious updates to four established Open VSX extensions: FTP/SFTP/SSH Sync Tool, I18n Tools, vscode mindmap, and scss to css. These extensions, collectively downloaded over 22,000 times, were weaponized to deliver the GlassWorm malware loader. GlassWorm is a sophisticated malware known for its runtime decryption and use of EtherHiding, a technique that conceals command-and-control (C2) communications by embedding them in blockchain transactions (Solana memos). The malware activates only after profiling the infected machine to exclude Russian locales, a tactic to evade local law enforcement. Once active, GlassWorm harvests a wide range of sensitive information including browser data (logins, cookies, history), cryptocurrency wallet files (Electrum, Exodus, Ledger Live, etc.), Apple macOS credentials (iCloud Keychain, Safari cookies), Apple Notes documents, FortiClient VPN configs, and developer credentials such as AWS and SSH keys. The malware also inspects npm and GitHub authentication tokens, enabling attackers to access private repositories, continuous integration secrets, and release automation pipelines. This attack is notable for using a compromised developer account to distribute malware, contrasting with prior GlassWorm campaigns that relied on typosquatting or brandjacking. The use of encrypted loaders and dynamic C2 infrastructure rotation complicates detection via static indicators, shifting the defender advantage towards behavioral analytics and rapid response. The incident underscores the critical risks posed by supply chain attacks in open-source extension ecosystems, especially those targeting developer tools that can facilitate deeper enterprise compromise.

European organizations using Open VSX extensions, particularly those relying on the affected developer tools, face significant risks from this supply chain attack. The theft of developer credentials and cloud authentication tokens can lead to unauthorized access to private code repositories, CI/CD pipelines, and cloud infrastructure, enabling lateral movement and data exfiltration. The malware’s ability to harvest cryptocurrency wallets and sensitive macOS credentials poses direct financial risks and potential identity theft. Enterprises with macOS-based development environments or those using FortiClient VPN are especially vulnerable. The selective activation excluding Russian locales suggests a threat actor motivated to avoid local prosecution, indicating a persistent and targeted campaign. The attack undermines trust in open-source supply chains and highlights the need for stringent credential management and supply chain security. Given the widespread use of Open VSX extensions across Europe, the potential for widespread impact exists, particularly in sectors with high dependency on developer tools such as technology, finance, and research institutions.

European organizations should immediately audit their use of Open VSX extensions, particularly those published by the 'oorzc' author, and remove or update any affected versions. Implement multi-factor authentication (MFA) and rotate all developer publishing credentials to prevent unauthorized access. Employ behavioral detection tools capable of identifying runtime-decrypted payloads and unusual network activity such as blockchain-based C2 communications. Conduct thorough endpoint detection and response (EDR) investigations focusing on macOS systems to identify indicators of GlassWorm infection. Secure developer environments by isolating build and publishing processes, and monitor npm and GitHub tokens for unauthorized use. Enforce strict access controls on cloud and CI/CD environments, and audit logs for suspicious activity. Educate developers on supply chain risks and encourage the use of signed and verified extensions. Collaborate with Open VSX Registry maintainers to enhance security measures around extension publishing and token management. Finally, implement network segmentation to limit lateral movement if compromise occurs.