73 Open VSX Sleeper Extensions Linked to GlassWorm Activate New Malware Campaign

Cybersecuritynews •Abinaya • April 26, 2026

The GlassWorm supply chain attack targeting the Open VSX marketplace has escalated with the discovery of 73 new “sleeper” extensions. Identified in April 2026, this cluster marks a dangerous shift in how threat actors distribute malware to software developers. This activity follows a major wave discovered in March 2026, where researchers documented 72 malicious Open […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Malware Campaign Targets OpenVSX with 73 Malicious Extensions A resurgence of the GlassWorm malware campaign has been identified, targeting the OpenVSX ecosystem with 73 'sleeper' extensions that become malicious after updates. Six of these extensions have already been activated to deliver malware, while the remaining are suspected to be dormant. Initially benign, these extensions are designed to trick developers by mimicking legitimate ones, utilizing similar icons and descriptions. The campaign is a continuation of a supply chain attack strategy first observed in October 2025, which has previously affected various ecosystems, including GitHub and npm packages. The latest wave follows a significant attack in March 2026, which impacted hundreds of repositories. Researchers from Socket have recommended that developers who installed any of the affected extensions rotate their secrets and clean their environments. The full list of the 73 extensions has been published for awareness and mitigation. 7 sources 73

Extracted Entities

73 Open VSX Sleeper Extensions Linked to GlassWorm Activate New Malware Campaign

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (1)