Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

Security researchers identified a cluster of malicious Visual Studio Code extensions spanning the VS Code Marketplace and Open VSX registries, linked to the GlassWorm supply chain campaign. Two confirmed malicious themes include Aurora Nocturne Night Theme, which downloads and executes batch files controlled by threat actors, and Cosmic Nebula Themes, which contains a staged loader decrypting embedded JavaScript, performing Russian-language gating, and leveraging Solana blockchain transaction memos to dynamically resolve payload infrastructure. The cluster comprises at least ten extensions with over 8,000 installs on the Visual Studio Marketplace and tens of thousands on Open VSX. Git history and source code analysis confirm the connection to GlassWorm. Several extensions remain unweaponized but retain executable capabilities, posing ongoing risk. The operation uses brandjacking and sophisticated infrastructure rotation techniques to evade detection.

The campaign enables threat actors to execute arbitrary code on users' systems through malicious Visual Studio Code extensions, potentially leading to credential theft and supply chain compromise. The use of dynamic payload resolution and infrastructure rotation increases the difficulty of detection and mitigation. The widespread distribution and significant installation counts amplify the risk to developers using these extensions. Although no active exploits in the wild are confirmed, the presence of executable capabilities in unweaponized extensions indicates potential for future malicious activity.

No official patch or vendor advisory is provided for these malicious extensions. Users should immediately uninstall any suspicious or untrusted Visual Studio Code extensions, especially those identified as part of this campaign (e.g., Aurora Nocturne Night Theme, Cosmic Nebula Themes). Review installed extensions for any matching indicators such as hashes or domains associated with this campaign. Exercise caution when installing extensions from third-party registries like Open VSX. Monitor security advisories from Visual Studio Code and related marketplaces for updates. Since this is a supply chain campaign, organizations should consider implementing policies to restrict or audit extension installations.