GlassWorm goes native: New Zig dropper infects every IDE on your machine

We have been tracking GlassWorm for over a year. It first appeared in March 2025 , when Aikido discovered malicious npm packages hiding payloads inside invisible Unicode characters. The campaign has expanded repeatedly since then, compromising hundreds of projects across GitHub, npm, and VS Code , and most recently delivering a persistent RAT through a fake Chrome extension that logged keystrokes and dumped session cookies. The group keeps iterating, and they just made a meaningful jump.

We observed this new technique in an OpenVSX extension called code-wakatime-activity-tracker . The extension impersonates WakaTime, the popular developer time-tracking tool, and ships a Zig-compiled native binary alongside its JavaScript code. This is not the first time GlassWorm resorted to using native compiled code in extensions. However, rather than using the binary as the payload directly, it is used as a stealthy indirection for the known GlassWorm dropper , which now secretly infects all other IDEs it can find on your system.

The extension code-wakatime-activity-tracker , published on OpenVSX, is nearly identical to the legitimate WakaTime extension on the surface: same command registrations, same API key prompts, same status bar icons. The divergence happens in one place: the activate() function.

Before any WakaTime logic runs, the extension loads a native binary from the ./bin/ directory bundled alongside the extension and immediately calls install() . On Windows this is win.node , a PE32+ DLL. On macOS it is mac.node , a universal Mach-O covering both x86_64 and arm64. These are Node.js native addons: compiled shared libraries that load directly into Node's runtime and execute outside the JavaScript sandbox with full OS-level access. Both are written in Zig. The macOS binary was compiled with debug symbols intact, revealing a project path /Users/davidioasd/Downloads/vsx_installer_zig .

Once loaded, the binary's first job is to find every IDE installed on the machine that supports the VS Code extension format. It then silently installs a malicious extension into each one it finds.

Windows (from win.node ) :

macOS (from mac.node ):

This is not a VS Code-only attack: it covers the entire ecosystem of editors that the same extension system: VS Code, VS Code Insiders, Cursor, Windsurf, VSCodium, and Positron. A developer running Cursor as their primary editor but with VS Code also installed would find both compromised.

‍ With the IDE list built, the binary fetches a malicious .vsix from a GitHub Releases page controlled by the attacker:

The package impersonates steoates.autoimport , a legitimate and popular VS Code extension with millions of installs. The downloaded .vsix is written to a temporary path, then silently installed into every IDE found in the step using each editor's own CLI installer. On Windows this runs through cmd.exe :

After installation, cleanupVsix deletes the downloaded file to remove the evidence.

The force-installed .vsix is the same GlassWorm dropper we have been tracking and analyzing in-depth . It geofences Russian systems, beacons to a Solana blockchain-based C2, and in our analysis we found it performs secret exfiltration and installs a persistent RAT, including a malicious chrome extension.

Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically.