GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GlassWorm Campaign Expands with 72 Malicious Open VSX Extensions The GlassWorm malware campaign has intensified its operations by utilizing 72 newly identified malicious Open VSX extensions. These extensions exploit transitive dependencies within developer environments, allowing the malware to spread more effectively. The Socket Research Team reported these findings on March 13, 2026, highlighting the campaign's sophisticated approach of embedding malicious payloads in dependencies rather than directly in initial extensions. This method broadens the attack surface, potentially affecting numerous developers and organizations using vulnerable extensions. The campaign continues to employ advanced techniques such as staged JavaScript execution and in-memory code execution. As of now, specific CVEs and remediation steps have not been disclosed, but the threat remains significant. Security professionals are advised to remain vigilant and monitor their environments for unusual activity related to these extensions. 8 sources 67