News

Security analysts have identified a large group of Microsoft Visual Studio Code (VS Code) extensions hosted on the Open VSX registry that are tied to an ongoing information-stealing operation known as GlassWorm. The cluster contains 73 extensions that are copies of legitimate add-ons, and investigators say these clones are part of a coordinated effort to deliver malware to developers.

Of the 73 impostor packages, six have been positively confirmed as malicious. The remainder appear to be sleeper packages: ostensibly benign at first to accumulate installs and credibility, then later updated to reveal their hostile behavior. The application security firm Socket is tracking this latest wave under the name GlassWorm v2 and reports that all of the suspect extensions were uploaded at the beginning of the month. Socket also notes that investigators have uncovered over 320 related artifacts dating back to December 21, 2025.

The extensions that Socket has confirmed as malicious include the following names:

• outsidestormcommand.monochromator-theme
• keyacrosslaud.auto-loop-for-antigravity
• krundoven.ironplc-fast-hub
• boulderzitunnel.vscode-buddies
• cubedivervolt.html-code-validate
• winnerdomain17.version-lens-tool

The cloned packages rely on typosquatting and mimicry to deceive users. In some cases the fake package names closely resemble real ones (for example, CEINTL.vscode-language-pack-tr vs. Emotionkyoseparate.turkish-language-pack), and the impostors reuse the same icons and descriptions as the authentic extensions. By reproducing the visual elements of trusted projects, the attackers leverage what researchers call “visual trust” to inflate install counts organically before delivering a malicious update.

Socket’s analysis describes how the adversaries behind GlassWorm v2 have refined their tactics. Rather than relying solely on an immediately malicious binary, operators are moving toward sleeper extensions and leveraging transitive dependency chains to make detection harder. They are also using Zig-based droppers to fetch and execute a secondary VSIX package hosted on GitHub, enabling the campaign to target all IDEs present on an infected developer’s workstation.

In practice, the bogus Open VSX extensions behave like innocuous loaders: once activated, they download a VSIX payload from GitHub and install it across every supported IDE discovered on the system. Socket observed the attacker using the standard --install-extension mechanism to push the payload into environments including VS Code, Cursor, Windsurf, and VSCodium.

Regardless of the delivery mechanics, the campaign’s objectives remain consistent. The malware is designed to skip systems located within Russia, harvest sensitive information, deploy a remote access trojan (RAT), and quietly install a malicious Chromium-based browser extension to scrape credentials, bookmarks and other user data.

Socket emphasizes that this variant accomplishes the same end result as previous binary-based attacks but shifts the delivery logic into obfuscated JavaScript inside extensions. In their assessment, the initial package acts as a loader while the real malicious component is downloaded and executed after the extension is activated.