GlassWorm Resurfaces: 24 Malicious Extensions Masquerade as Popular Developer Tools
The notorious supply chain attack known as GlassWorm has reemerged, infiltrating both the Microsoft Visual Studio Marketplace and Open VSX with 24 malicious extensions. These extensions impersonate widely-used developer tools and frameworks, including Flutter, React, Tailwind, Vim, and Vue, posing significant risks to developers worldwide.
Background on GlassWorm
First identified in October 2025, GlassWorm is a sophisticated malware campaign that leverages the Solana blockchain for command-and-control (C2) operations. Its primary objectives include harvesting credentials from npm, Open VSX, GitHub, and Git repositories, draining cryptocurrency assets from numerous wallets, and converting developer machines into nodes under attacker control for various illicit activities.
A particularly alarming aspect of GlassWorm is its ability to exploit stolen credentials to compromise additional packages and extensions, facilitating a worm-like propagation. Despite concerted efforts by Microsoft and Open VSX to mitigate the threat, the malware resurfaced last month, with attackers extending their focus to GitHub repositories.
Recent Developments
In the latest wave of the GlassWorm campaign, cybersecurity researcher John Tuckner from Secure Annex identified 24 malicious extensions distributed across both the Visual Studio Marketplace and Open VSX. These extensions are designed to deceive developers by mimicking legitimate tools, thereby increasing the likelihood of installation.
Identified Malicious Extensions
Visual Studio Marketplace:
– iconkieftwo.icon-theme-materiall
– prisma-inc.prisma-studio-assistance (removed as of December 1, 2025)
– prettier-vsc.vsce-prettier
– flutcode.flutter-extension
– csvmech.csvrainbow
– codevsce.codelddb-vscode
– saoudrizvsce.claude-devsce
– clangdcode.clangd-vsce
– cweijamysq.sync-settings-vscode
– bphpburnsus.iconesvscode
– klustfix.kluster-code-verify
– vims-vsce.vscode-vim
– yamlcode.yaml-vscode-extension
– solblanco.svetle-vsce
– vsceue.volar-vscode
– redmat.vscode-quarkus-pro
– msjsdreact.react-native-vsce
Open VSX:
– bphpburn.icons-vscode
– tailwind-nuxt.tailwindcss-for-react
– flutcode.flutter-extension
– yamlcode.yaml-vscode-extension
– saoudrizvsce.claude-dev
– saoudrizvsce.claude-devsce
– vitalik.solidity
Tactics Employed by Attackers
The perpetrators have been observed artificially inflating download counts to enhance the perceived credibility of these extensions. This manipulation ensures that the malicious extensions appear prominently in search results, often adjacent to the legitimate projects they impersonate, thereby increasing the likelihood of unsuspecting developers installing them.
Tuckner noted, Once the extension has been approved initially, the attacker seems to easily be able to update code with a new malicious version and easily evade filters. Many code extensions begin with an ‘activate’ context, and the malicious code is slipped in right after the activation occurs.
Technical Analysis of the Malware
This iteration of GlassWorm continues to utilize invisible Unicode characters to conceal malicious code within the extensions. Notably, it incorporates Rust-based implants packaged inside the extensions. An analysis of the icon-theme-materiall extension by Nextron Systems revealed two Rust implants targeting both Windows and macOS systems:
– A Windows DLL named os.node
– A macOS dynamic library named darwin.node
Consistent with previous GlassWorm infections, these implants are designed to retrieve C2 server details from a Solana blockchain wallet address. They then download the next-stage payload, an encrypted JavaScript file. As a contingency, the implants can parse a Google Calendar event to obtain the C2 address.
Tuckner emphasized the scale of the threat, stating, Rarely does an attacker publish 20+ malicious extensions across both of the most popular marketplaces in a week. Many developers could easily be fooled by these extensions and are just one click away from compromise.
Implications and Recommendations
The resurgence of GlassWorm underscores the persistent vulnerabilities within the software supply chain, particularly concerning developer tools. Developers are urged to exercise heightened vigilance when selecting and installing extensions. Key recommendations include:
1. Verify Extension Authenticity: Before installation, thoroughly research extensions, paying close attention to the publisher’s credibility and user reviews.
2. Monitor for Unusual Activity: Be alert to unexpected behaviors or performance issues in your development environment, which may indicate malicious activity.
3. Regularly Update Security Measures: Ensure that all security tools and protocols are up-to-date to detect and mitigate emerging threats effectively.
4. Limit Extension Usage: Install only essential extensions to minimize potential attack vectors.
5. Stay Informed: Keep abreast of the latest cybersecurity developments and advisories related to developer tools and extensions.
By adopting these practices, developers can significantly reduce the risk of falling victim to sophisticated supply chain attacks like GlassWorm.
