Back Cybersecuritynews

GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach

Cybersecuritynews •Dhivya • March 14, 2026

In a major escalation of supply chain attacks, the GlassWorm malware campaign has evolved to infect developer environments using transitive dependencies. On March 13, 2026, the Socket Research Team reported identifying at least 72 new malicious Open VSX extensions linked to this campaign. Instead of placing the malicious payload directly into an initial extension, threat […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Campaign Expands with 72 Malicious Open VSX Extensions The GlassWorm malware campaign has intensified its operations by utilizing 72 newly identified malicious Open VSX extensions. These extensions exploit transitive dependencies within developer environments, allowing the malware to spread more effectively. The Socket Research Team reported these findings on March 13, 2026, highlighting the campaign's sophisticated approach of embedding malicious payloads in dependencies rather than directly in initial extensions. This method broadens the attack surface, potentially affecting numerous developers and organizations using vulnerable extensions. The campaign continues to employ advanced techniques such as staged JavaScript execution and in-memory code execution. As of now, specific CVEs and remediation steps have not been disclosed, but the threat remains significant. Security professionals are advised to remain vigilant and monitor their environments for unusual activity related to these extensions. 8 sources 67

Extracted Entities

GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

Malware (1)

MITRE ATT&CK (1)