GlassWorm is a sophisticated, self-spreading malware campaign targeting Visual Studio Code (VS Code) extensions hosted on the Open VSX Registry and Microsoft Extension Marketplace. Discovered by Koi Security researchers, it represents a novel supply chain attack that autonomously propagates through the developer ecosystem. The worm uses invisible Unicode variation selectors to conceal malicious code within legitimate extensions, making detection difficult. It leverages the Solana blockchain to retrieve command-and-control (C2) instructions embedded in blockchain transactions, providing a resilient and decentralized infrastructure that is resistant to takedown. Google Calendar is used as a fallback C2 channel, further complicating mitigation efforts. Upon infection, GlassWorm steals sensitive developer credentials from npm, Open VSX, GitHub, and Git, as well as draining funds from 49 cryptocurrency wallet extensions. It installs SOCKS proxy servers to route malicious traffic, hidden VNC servers (HVNC) for remote access, and uses WebRTC and BitTorrent DHT for decentralized command distribution. The worm exploits VS Code’s auto-update feature to push malicious updates without user interaction, enabling rapid and stealthy spread. The initial infection wave began on October 17, 2025, affecting 13 Open VSX extensions and one Microsoft Marketplace extension, collectively downloaded approximately 35,800 times. The attack’s end goal is to harvest credentials and cryptocurrency assets, then use those to compromise further packages, creating a self-sustaining worm that spreads like wildfire through the software development supply chain. This attack follows shortly after the Shai-Hulud worm targeting the npm ecosystem, indicating a trend of increasingly sophisticated supply chain attacks in DevOps environments. The use of blockchain for C2 infrastructure is a novel tactic that leverages pseudonymity and decentralization to evade detection and takedown, complicating incident response efforts.

For European organizations, GlassWorm poses a significant risk to software development and DevOps environments, especially those relying on VS Code and its extensions. The theft of developer credentials and tokens can lead to widespread compromise of source code repositories, CI/CD pipelines, and package registries, potentially resulting in the insertion of malicious code into production software. The deployment of SOCKS proxies and hidden VNC servers on infected developer machines can facilitate further criminal activities such as anonymized attacks, data exfiltration, and lateral movement within corporate networks. The draining of cryptocurrency wallets impacts organizations and developers involved in blockchain and crypto projects. The worm’s ability to auto-update and propagate without user interaction increases the risk of rapid infection spread across European development teams, potentially affecting critical infrastructure and software supply chains. The use of blockchain and Google Calendar for C2 complicates detection and mitigation, increasing dwell time and potential damage. This threat could disrupt software development lifecycles, erode trust in open-source ecosystems, and cause financial and reputational damage to European tech companies and startups.

European organizations should implement a multi-layered defense strategy focused on supply chain security and developer environment hardening. First, enforce strict vetting and monitoring of VS Code extensions used internally, including verifying extension publisher authenticity and scanning for suspicious Unicode characters or obfuscated code. Employ automated tools to analyze extension updates for anomalous behavior before deployment. Disable or tightly control auto-update features for extensions in sensitive environments. Implement credential hygiene by using hardware security modules (HSMs) or secure vaults for storing developer tokens and credentials, and enforce multi-factor authentication (MFA) on all developer accounts and package registries. Monitor network traffic for unusual outbound connections, especially to known malicious IPs or blockchain-related endpoints. Deploy endpoint detection and response (EDR) solutions capable of identifying proxy servers, hidden VNC servers, and unusual WebRTC or BitTorrent DHT activity. Educate developers on supply chain risks and encourage the use of ephemeral or isolated development environments. Collaborate with extension marketplaces to report and remove infected extensions promptly. Finally, maintain an incident response plan tailored to supply chain compromise scenarios, including rapid credential revocation and forensic analysis.