GlassWorm Supply-Chain Attack Hijacks 72 VS Code Extensions and 151 GitHub Repositories to Steal Developer Credentials
A coordinated supply-chain campaign abused Open VSX extension dependencies and invisible Unicode payloads to compromise developer environments across VS Code and GitHub.
Overview
A supply-chain campaign known as GlassWorm has compromised at least 72 extensions on the Open VSX marketplace and injected malicious code into more than 150 GitHub repositories, according to concurrent advisories from Socket and Aikido published between March 13 and 14. The campaign targets developers by disguising malware as popular coding utilities and using a transitive dependency trick that causes editors to silently install malicious payloads alongside trusted tools.
What We Know
Socket’s research team identified the 72 malicious Open VSX extensions beginning January 31, 2026. The extensions impersonated widely used developer tools including linters, formatters, language packs for Angular, Flutter, Python, and Vue, as well as AI coding assistants like Claude Code and Google Antigravity, according to CSO Online.
The attack relies on a transitive delivery model. Extensions initially appear clean and pass marketplace review checks. After gaining user trust and accumulating installations, the attackers update them to declare dependencies on separate extensions containing the GlassWorm loader via extensionPack or extensionDependencies fields. When a developer installs or updates the parent extension, VS Code automatically pulls in all referenced dependencies, including the malicious payload, as The Hacker News reported.
In a parallel campaign wave between March 3 and 9, attackers injected at least 151 GitHub repositories with invisible Unicode characters drawn from Private Use Area ranges that encode malicious JavaScript payloads inside what appears to be an empty string. When processed by a JavaScript runtime via eval(), the hidden payload decodes and executes a loader that fetches a second-stage script, according to Aikido. Compromised repositories included projects with significant community followings such as pedronauck/reworm, which has over 1,400 GitHub stars.
The campaign uses Solana blockchain transactions as a dead-drop resolver for its command-and-control infrastructure, a technique that improves resilience by making takedown efforts more difficult. Once active, the malware steals tokens, credentials, secrets from CI/CD systems, environment variables, and cryptocurrency wallet contents. Infected systems can also be repurposed as criminal proxies, according to The Hacker News.
Researchers noted that the malicious commits to GitHub repositories were accompanied by realistic documentation updates, version bumps, and small refactors tailored to each project, strongly suggesting that large language models were used to generate convincing cover commits, as Aikido observed.
Open VSX has removed the majority of the transitively malicious extensions from its registry, though Socket researchers noted that a few remained live as of March 13.
What We Don’t Know
The total number of developers affected has not been disclosed, and the true scope of GitHub repository compromises may be larger than the 151 identified, since deleted repositories are not reflected in search results. Attribution remains unclear. A related cluster of activity involving 88 npm packages distributed through 50 disposable accounts, tracked as PhantomRaven, was initially linked to the same threat actors but has been challenged by Endor Labs as potentially a security researcher experiment, though excessive data collection and deliberately rotated credentials suggest otherwise.
It is also unknown how the attackers obtained the access needed to push commits to established GitHub repositories. Whether this involved stolen tokens, compromised maintainer accounts, or exploitation of GitHub’s permission model has not been publicly detailed.
Analysis
The GlassWorm campaign represents a meaningful evolution in developer-targeted supply-chain attacks. By exploiting the implicit trust that extension marketplaces and dependency systems place in transitive relationships, the attackers bypassed the primary layer of defense that developers rely on: installing only from known, reviewed sources. The use of blockchain-based command-and-control infrastructure and AI-generated cover commits adds operational resilience and sophistication that raises the cost of detection and response.
Developers and organizations should audit their installed VS Code extensions and their dependency trees, monitor for unexpected dependency additions in extension updates, and restrict installations to verified publishers where possible. The campaign underscores that extension marketplaces now face the same dependency-abuse risks that have long plagued package registries like npm and PyPI.