Developer-Targeting Glassworm Malware Abuses npm, PyPI, OpenVSX, and GitHub

Cybersecuritynews •Tushar Subhra Dutta • May 27, 2026

A dangerous malware campaign known as Glassworm has been spreading through the tools that software developers trust most every day. By abusing popular platforms like npm, PyPI, OpenVSX, and GitHub, the attackers have turned routine development workflows into entry points for data theft, credential harvesting, and persistent system access. The campaign first surfaced in October […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Glassworm Botnet Targeting Developers Disrupted by CrowdStrike and Google The Glassworm botnet, which has targeted software developers since early 2025, was taken down in a coordinated operation by CrowdStrike, Google, and the Shadowserver Foundation on May 26, 2026. This botnet utilized sophisticated command-and-control (C2) infrastructure, including the Solana blockchain, Google Calendar, and BitTorrent networks, to spread malware through compromised open-source packages and malicious VS Code extensions. The operation affected numerous systems across Windows, macOS, and Linux, compromising over 300 GitHub repositories and various npm and Python packages. The malware, known for its invisible code injection techniques, has been linked to credential theft and remote access capabilities. As of the takedown, all four C2 channels were severed, preventing further malware distribution. The attack's sophistication highlights a significant shift in targeting developers rather than just software products. 22 sources 71

Extracted Entities

Developer-Targeting Glassworm Malware Abuses npm, PyPI, OpenVSX, and GitHub

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)

Platforms (2)

Tools (1)