Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
Source Reddit InfoSec News
Description
The GlassWorm malware is a self-spreading malicious software targeting OpenVSX and VS Code extension registries. It propagates by infecting extensions within these registries, potentially compromising developers and users who download affected extensions. This malware can lead to unauthorized code execution, data theft, and supply chain compromise. European organizations relying on VS Code and OpenVSX for software development are at risk of indirect infection through compromised extensions. The malware's self-spreading nature increases the risk of rapid proliferation across development environments. Mitigation requires rigorous extension vetting, monitoring for unusual extension behavior, and restricting extension installation policies. Countries with significant software development sectors and high adoption of VS Code and OpenVSX, such as Germany, France, and the UK, are most likely to be affected. Given the high impact on confidentiality and integrity, ease of spread, and no need for user interaction beyond extension installation, the threat severity is assessed as high.